Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1656741
| Path | csiph.com!news.redatomik.org!news.albasani.net!news.mixmin.net!news.unit0.net!news.panservice.it!bofh.it!news.nic.it!robomod |
|---|---|
| From | Adam Borowski <kilobyte@angband.pl> |
| Newsgroups | linux.kernel |
| Subject | [PATCH 2/5] vt: fix unchecked __put_user() in tioclinux ioctls |
| Date | Sat, 03 Jun 2017 09:40:02 +0200 |
| Message-ID | <tObPc-45V-11@gated-at.bofh.it> (permalink) |
| References | <tObPc-45V-5@gated-at.bofh.it> <tObPc-45V-3@gated-at.bofh.it> |
| X-Original-To | Greg Kroah-Hartman <gregkh@linuxfoundation.org>, Jiri Slaby <jslaby@suse.com>, linux-kernel@vger.kernel.org |
| X-Mailer | git-send-email 2.11.0 |
| X-Sa-Exim-Connect-IP | 89.71.161.30 |
| X-Sa-Exim-Mail-From | kilobyte@angband.pl |
| X-Sa-Exim-Version | 4.2.1 (built Tue, 02 Aug 2016 21:08:31 +0000) |
| X-Sa-Exim-Scanned | Yes (on tartarus.angband.pl) |
| Sender | robomod@news.nic.it |
| List-ID | <linux-kernel.vger.kernel.org> |
| X-Mailing-List | linux-kernel@vger.kernel.org |
| Approved | robomod@news.nic.it |
| Lines | 47 |
| Organization | linux.* mail to news gateway |
| X-Original-Cc | Adam Borowski <kilobyte@angband.pl>, stable@vger.kernel.org, #@umbar.angband.pl, v3.7-@umbar.angband.pl |
| X-Original-Date | Sat, 3 Jun 2017 09:35:06 +0200 |
| X-Original-Message-ID | <20170603073509.4718-2-kilobyte@angband.pl> |
| X-Original-References | <20170603073255.zgpfmdp2pqusz4qw@angband.pl> <20170603073509.4718-1-kilobyte@angband.pl> |
| X-Original-Sender | linux-kernel-owner@vger.kernel.org |
| Xref | csiph.com linux.kernel:1656741 |
Show key headers only | View raw
Only read access is checked before this call.
Actually, at the moment this is not an issue, as every in-tree arch does
the same manual checks for VERIFY_READ vs VERIFY_WRITE, relying on the MMU
to tell them apart, but this wasn't the case in the past and may happen
again on some odd arch in the future.
If anyone cares about 3.7 and earlier, this is a security hole (untested)
on real 80386 CPUs.
Signed-off-by: Adam Borowski <kilobyte@angband.pl>
CC: stable@vger.kernel.org # v3.7-
---
drivers/tty/vt/vt.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
index 9309c7da660a..2ebaba16f785 100644
--- a/drivers/tty/vt/vt.c
+++ b/drivers/tty/vt/vt.c
@@ -2709,13 +2709,13 @@ int tioclinux(struct tty_struct *tty, unsigned long arg)
* related to the kernel should not use this.
*/
data = vt_get_shift_state();
- ret = __put_user(data, p);
+ ret = put_user(data, p);
break;
case TIOCL_GETMOUSEREPORTING:
console_lock(); /* May be overkill */
data = mouse_reporting();
console_unlock();
- ret = __put_user(data, p);
+ ret = put_user(data, p);
break;
case TIOCL_SETVESABLANK:
console_lock();
@@ -2724,7 +2724,7 @@ int tioclinux(struct tty_struct *tty, unsigned long arg)
break;
case TIOCL_GETKMSGREDIRECT:
data = vt_get_kmsg_redirect();
- ret = __put_user(data, p);
+ ret = put_user(data, p);
break;
case TIOCL_SETKMSGREDIRECT:
if (!capable(CAP_SYS_ADMIN)) {
--
2.11.0
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 1/5] vt: use copy_from/to_user instead of __get/put_user for scrnmap ioctls Adam Borowski <kilobyte@angband.pl> - 2017-06-03 09:40 +0200
[PATCH 5/5] vt: drop access_ok() calls in unimap ioctls Adam Borowski <kilobyte@angband.pl> - 2017-06-03 09:40 +0200
[PATCH 2/5] vt: fix unchecked __put_user() in tioclinux ioctls Adam Borowski <kilobyte@angband.pl> - 2017-06-03 09:40 +0200
[PATCH 3/5] vt: use copy_to_user instead of __put_user in GIO_UNIMAP ioctl Adam Borowski <kilobyte@angband.pl> - 2017-06-03 09:40 +0200
Re: [PATCH 3/5] vt: use copy_to_user instead of __put_user in GIO_UNIMAP ioctl Alan Cox <gnomes@lxorguk.ukuu.org.uk> - 2017-06-05 18:40 +0200
Re: [PATCH 3/5] vt: use copy_to_user instead of __put_user in GIO_UNIMAP ioctl Al Viro <viro@ZenIV.linux.org.uk> - 2017-06-06 01:10 +0200
[PATCH 4/5] vt: use memdup_user in PIO_UNIMAP ioctl Adam Borowski <kilobyte@angband.pl> - 2017-06-03 09:40 +0200
csiph-web