mirror of
https://github.com/FEX-Emu/linux.git
synced 2024-12-24 02:18:54 +00:00
5f6279da37
There's a code path in pmcraid that can be reached via device ioctl that causes all sorts of ugliness, including heap corruption or triggering the OOM killer due to consecutive allocation of large numbers of pages. Not especially relevant from a security perspective, since users must have CAP_SYS_ADMIN to open the character device. First, the user can call pmcraid_chr_ioctl() with a type PMCRAID_PASSTHROUGH_IOCTL. A pmcraid_passthrough_ioctl_buffer is copied in, and the request_size variable is set to buffer->ioarcb.data_transfer_length, which is an arbitrary 32-bit signed value provided by the user. If a negative value is provided here, bad things can happen. For example, pmcraid_build_passthrough_ioadls() is called with this request_size, which immediately calls pmcraid_alloc_sglist() with a negative size. The resulting math on allocating a scatter list can result in an overflow in the kzalloc() call (if num_elem is 0, the sglist will be smaller than expected), or if num_elem is unexpectedly large the subsequent loop will call alloc_pages() repeatedly, a high number of pages will be allocated and the OOM killer might be invoked. Prevent this value from being negative in pmcraid_ioctl_passthrough(). Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com> Cc: stable@kernel.org Cc: Anil Ravindranath <anil_ravindranath@pmc-sierra.com> Signed-off-by: James Bottomley <James.Bottomley@suse.de> |
||
|---|---|---|
| .. | ||
| aacraid | ||
| aic7xxx | ||
| aic7xxx_old | ||
| aic94xx | ||
| arcmsr | ||
| arm | ||
| be2iscsi | ||
| bfa | ||
| bnx2fc | ||
| bnx2i | ||
| cxgbi | ||
| device_handler | ||
| dpt | ||
| fcoe | ||
| fnic | ||
| ibmvscsi | ||
| libfc | ||
| libsas | ||
| lpfc | ||
| megaraid | ||
| mpt2sas | ||
| mvsas | ||
| osd | ||
| pcmcia | ||
| pm8001 | ||
| qla2xxx | ||
| qla4xxx | ||
| sym53c8xx_2 | ||
| .gitignore | ||
| 3w-9xxx.c | ||
| 3w-9xxx.h | ||
| 3w-sas.c | ||
| 3w-sas.h | ||
| 3w-xxxx.c | ||
| 3w-xxxx.h | ||
| 53c700_d.h_shipped | ||
| 53c700.c | ||
| 53c700.h | ||
| 53c700.scr | ||
| a100u2w.c | ||
| a100u2w.h | ||
| a2091.c | ||
| a2091.h | ||
| a3000.c | ||
| a3000.h | ||
| a4000t.c | ||
| advansys.c | ||
| aha152x.c | ||
| aha152x.h | ||
| aha1542.c | ||
| aha1542.h | ||
| aha1740.c | ||
| aha1740.h | ||
| aic7xxx_old.c | ||
| atari_NCR5380.c | ||
| atari_scsi.c | ||
| atari_scsi.h | ||
| atp870u.c | ||
| atp870u.h | ||
| BusLogic.c | ||
| BusLogic.h | ||
| bvme6000_scsi.c | ||
| ch.c | ||
| constants.c | ||
| dc395x.c | ||
| dc395x.h | ||
| dmx3191d.c | ||
| dpt_i2o.c | ||
| dpti.h | ||
| dtc.c | ||
| dtc.h | ||
| eata_generic.h | ||
| eata_pio.c | ||
| eata_pio.h | ||
| eata.c | ||
| esp_scsi.c | ||
| esp_scsi.h | ||
| fd_mcs.c | ||
| fdomain.c | ||
| fdomain.h | ||
| FlashPoint.c | ||
| g_NCR5380_mmio.c | ||
| g_NCR5380.c | ||
| g_NCR5380.h | ||
| gdth_ioctl.h | ||
| gdth_proc.c | ||
| gdth_proc.h | ||
| gdth.c | ||
| gdth.h | ||
| gvp11.c | ||
| gvp11.h | ||
| hosts.c | ||
| hpsa_cmd.h | ||
| hpsa.c | ||
| hpsa.h | ||
| hptiop.c | ||
| hptiop.h | ||
| ibmmca.c | ||
| imm.c | ||
| imm.h | ||
| in2000.c | ||
| in2000.h | ||
| initio.c | ||
| initio.h | ||
| ipr.c | ||
| ipr.h | ||
| ips.c | ||
| ips.h | ||
| iscsi_boot_sysfs.c | ||
| iscsi_tcp.c | ||
| iscsi_tcp.h | ||
| jazz_esp.c | ||
| Kconfig | ||
| lasi700.c | ||
| libiscsi_tcp.c | ||
| libiscsi.c | ||
| libsrp.c | ||
| mac53c94.c | ||
| mac53c94.h | ||
| mac_esp.c | ||
| mac_scsi.c | ||
| mac_scsi.h | ||
| Makefile | ||
| megaraid.c | ||
| megaraid.h | ||
| mesh.c | ||
| mesh.h | ||
| mvme16x_scsi.c | ||
| mvme147.c | ||
| mvme147.h | ||
| ncr53c8xx.c | ||
| ncr53c8xx.h | ||
| NCR53c406a.c | ||
| NCR5380.c | ||
| NCR5380.h | ||
| NCR_D700.c | ||
| NCR_D700.h | ||
| NCR_Q720.c | ||
| NCR_Q720.h | ||
| nsp32_debug.c | ||
| nsp32_io.h | ||
| nsp32.c | ||
| nsp32.h | ||
| osst_detect.h | ||
| osst_options.h | ||
| osst.c | ||
| osst.h | ||
| pas16.c | ||
| pas16.h | ||
| pmcraid.c | ||
| pmcraid.h | ||
| ppa.c | ||
| ppa.h | ||
| ps3rom.c | ||
| qla1280.c | ||
| qla1280.h | ||
| qlogicfas408.c | ||
| qlogicfas408.h | ||
| qlogicfas.c | ||
| qlogicpti.c | ||
| qlogicpti.h | ||
| raid_class.c | ||
| script_asm.pl | ||
| scsi_debug.c | ||
| scsi_devinfo.c | ||
| scsi_error.c | ||
| scsi_ioctl.c | ||
| scsi_lib_dma.c | ||
| scsi_lib.c | ||
| scsi_logging.h | ||
| scsi_module.c | ||
| scsi_netlink.c | ||
| scsi_pm.c | ||
| scsi_priv.h | ||
| scsi_proc.c | ||
| scsi_sas_internal.h | ||
| scsi_scan.c | ||
| scsi_sysctl.c | ||
| scsi_sysfs.c | ||
| scsi_tgt_if.c | ||
| scsi_tgt_lib.c | ||
| scsi_tgt_priv.h | ||
| scsi_trace.c | ||
| scsi_transport_api.h | ||
| scsi_transport_fc_internal.h | ||
| scsi_transport_fc.c | ||
| scsi_transport_iscsi.c | ||
| scsi_transport_sas.c | ||
| scsi_transport_spi.c | ||
| scsi_transport_srp_internal.h | ||
| scsi_transport_srp.c | ||
| scsi_typedefs.h | ||
| scsi_wait_scan.c | ||
| scsi.c | ||
| scsi.h | ||
| scsicam.c | ||
| sd_dif.c | ||
| sd.c | ||
| sd.h | ||
| ses.c | ||
| sg.c | ||
| sgiwd93.c | ||
| sim710.c | ||
| sni_53c710.c | ||
| sr_ioctl.c | ||
| sr_vendor.c | ||
| sr.c | ||
| sr.h | ||
| st_options.h | ||
| st.c | ||
| st.h | ||
| stex.c | ||
| sun3_NCR5380.c | ||
| sun3_scsi_vme.c | ||
| sun3_scsi.c | ||
| sun3_scsi.h | ||
| sun3x_esp.c | ||
| sun_esp.c | ||
| sym53c416.c | ||
| sym53c416.h | ||
| t128.c | ||
| t128.h | ||
| tmscsim.c | ||
| tmscsim.h | ||
| u14-34f.c | ||
| ultrastor.c | ||
| ultrastor.h | ||
| vmw_pvscsi.c | ||
| vmw_pvscsi.h | ||
| wd33c93.c | ||
| wd33c93.h | ||
| wd7000.c | ||
| zalon.c | ||
| zorro7xx.c | ||