• Eric Dumazet's avatar
    isdn: fix kernel-infoleak in capi_unlocked_ioctl · d63967e4
    Eric Dumazet authored
    Since capi_ioctl() copies 64 bytes after calling
    capi20_get_manufacturer() we need to ensure to not leak
    information to user.
    
    BUG: KMSAN: kernel-infoleak in _copy_to_user+0x16b/0x1f0 lib/usercopy.c:32
    CPU: 0 PID: 11245 Comm: syz-executor633 Not tainted 4.20.0-rc7+ #2
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
    Call Trace:
     __dump_stack lib/dump_stack.c:77 [inline]
     dump_stack+0x173/0x1d0 lib/dump_stack.c:113
     kmsan_report+0x12e/0x2a0 mm/kmsan/kmsan.c:613
     kmsan_internal_check_memory+0x9d4/0xb00 mm/kmsan/kmsan.c:704
     kmsan_copy_to_user+0xab/0xc0 mm/kmsan/kmsan_hooks.c:601
     _copy_to_user+0x16b/0x1f0 lib/usercopy.c:32
     capi_ioctl include/linux/uaccess.h:177 [inline]
     capi_unlocked_ioctl+0x1a0b/0x1bf0 drivers/isdn/capi/capi.c:939
     do_vfs_ioctl+0xebd/0x2bf0 fs/ioctl.c:46
     ksys_ioctl fs/ioctl.c:713 [inline]
     __do_sys_ioctl fs/ioctl.c:720 [inline]
     __se_sys_ioctl+0x1da/0x270 fs/ioctl.c:718
     __x64_sys_ioctl+0x4a/0x70 fs/ioctl.c:718
     do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:291
     entry_SYSCALL_64_after_hwframe+0x63/0xe7
    RIP: 0033:0x440019
    Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00
    RSP: 002b:00007ffdd4659fb8 EFLAGS: 00000213 ORIG_RAX: 0000000000000010
    RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440019
    RDX: 0000000020000080 RSI: 00000000c0044306 RDI: 0000000000000003
    RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8
    R10: 0000000000000000 R11: 0000000000000213 R12: 00000000004018a0
    R13: 0000000000401930 R14: 0000000000000000 R15: 0000000000000000
    
    Local variable description: ----data.i@capi_unlocked_ioctl
    Variable was created at:
     capi_ioctl drivers/isdn/capi/capi.c:747 [inline]
     capi_unlocked_ioctl+0x82/0x1bf0 drivers/isdn/capi/capi.c:939
     do_vfs_ioctl+0xebd/0x2bf0 fs/ioctl.c:46
    
    Bytes 12-63 of 64 are uninitialized
    Memory access of size 64 starts at ffff88807ac5fce8
    Data copied to user address 0000000020000080
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
    Cc: Karsten Keil <isdn@linux-pingi.de>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    d63967e4
Name
Last commit
Last update
..
Kconfig Loading commit data...
Makefile Loading commit data...
capi.c Loading commit data...
capidrv.c Loading commit data...
capidrv.h Loading commit data...
capilib.c Loading commit data...
capiutil.c Loading commit data...
kcapi.c Loading commit data...
kcapi.h Loading commit data...
kcapi_proc.c Loading commit data...