Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1691521

[PATCH 3.18 19/28] vt: fix unchecked __put_user() in tioclinux ioctls

Show all headers | View raw

3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Adam Borowski <kilobyte@angband.pl>

commit 6987dc8a70976561d22450b5858fc9767788cc1c upstream.

Only read access is checked before this call.

Actually, at the moment this is not an issue, as every in-tree arch does
the same manual checks for VERIFY_READ vs VERIFY_WRITE, relying on the MMU
to tell them apart, but this wasn't the case in the past and may happen
again on some odd arch in the future.

If anyone cares about 3.7 and earlier, this is a security hole (untested)
on real 80386 CPUs.

Signed-off-by: Adam Borowski <kilobyte@angband.pl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/tty/vt/vt.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/drivers/tty/vt/vt.c
+++ b/drivers/tty/vt/vt.c
@@ -2687,13 +2687,13 @@ int tioclinux(struct tty_struct *tty, un
 	 * related to the kernel should not use this.
 	 */
 			data = vt_get_shift_state();
-			ret = __put_user(data, p);
+			ret = put_user(data, p);
 			break;
 		case TIOCL_GETMOUSEREPORTING:
 			console_lock();	/* May be overkill */
 			data = mouse_reporting();
 			console_unlock();
-			ret = __put_user(data, p);
+			ret = put_user(data, p);
 			break;
 		case TIOCL_SETVESABLANK:
 			console_lock();
@@ -2702,7 +2702,7 @@ int tioclinux(struct tty_struct *tty, un
 			break;
 		case TIOCL_GETKMSGREDIRECT:
 			data = vt_get_kmsg_redirect();
-			ret = __put_user(data, p);
+			ret = put_user(data, p);
 			break;
 		case TIOCL_SETKMSGREDIRECT:
 			if (!capable(CAP_SYS_ADMIN)) {

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.18 00/28] 3.18.62-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 13:20 +0200
  [PATCH 3.18 22/28] crypto: atmel - only treat EBUSY as transient if backlog Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 13:20 +0200
  [PATCH 3.18 25/28] sched/topology: Optimize build_group_mask() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 13:20 +0200
  [PATCH 3.18 16/28] fs/dcache.c: fix spin lockup issue on nlru->lock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 13:20 +0200
  [PATCH 3.18 19/28] vt: fix unchecked __put_user() in tioclinux ioctls Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 13:20 +0200
  [PATCH 3.18 12/28] parisc: DMA API: return error instead of BUG_ON for dma ops on non dma devs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 13:20 +0200
  [PATCH 3.18 08/28] cfg80211: Check if PMKID attribute is of expected size Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 13:30 +0200
  [PATCH 3.18 09/28] irqchip/gic-v3: Fix out-of-bound access in gic_set_affinity Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 13:30 +0200
  [PATCH 3.18 03/28] net: prevent sign extension in dev_get_stats() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 13:30 +0200
  [PATCH 3.18 14/28] tools/lib/lockdep: Reduce MAX_LOCK_DEPTH to avoid overflowing lock_chain/: Depth Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 13:30 +0200
  [PATCH 3.18 23/28] crypto: sha1-ssse3 - Disable avx2 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 13:30 +0200
  [PATCH 3.18 07/28] cfg80211: Validate frequencies nested in NL80211_ATTR_SCAN_FREQUENCIES Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 13:30 +0200
  [PATCH 3.18 01/28] ipv6: avoid unregistering inet6_dev for loopback Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 13:30 +0200
  [PATCH 3.18 04/28] ipv6: dad: dont remove dynamic addresses if link is down Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 13:30 +0200
  [PATCH 3.18 11/28] parisc: use compat_sys_keyctl() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 13:30 +0200
  Re: [PATCH 3.18 00/28] 3.18.62-stable review Guenter Roeck <linux@roeck-us.net> - 2017-07-19 22:40 +0200
  Re: [PATCH 3.18 00/28] 3.18.62-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-07-20 01:50 +0200
    Re: [PATCH 3.18 00/28] 3.18.62-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-20 07:10 +0200

csiph-web