Skip to content

Commit

Permalink
dm ioctl: prevent stack leak in dm ioctl call
Browse files Browse the repository at this point in the history
When calling a dm ioctl that doesn't process any data
(IOCTL_FLAGS_NO_PARAMS), the contents of the data field in struct
dm_ioctl are left initialized.  Current code is incorrectly extending
the size of data copied back to user, causing the contents of kernel
stack to be leaked to user.  Fix by only copying contents before data
and allow the functions processing the ioctl to override.

Cc: stable@vger.kernel.org
Signed-off-by: Adrian Salido <salidoa@google.com>
Reviewed-by: Alasdair G Kergon <agk@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
  • Loading branch information
Adrian Salido authored and Mike Snitzer committed Apr 27, 2017
1 parent 84ff1bc commit 4617f56
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion drivers/md/dm-ioctl.c
Original file line number Diff line number Diff line change
Expand Up @@ -1840,7 +1840,7 @@ static int ctl_ioctl(uint command, struct dm_ioctl __user *user)
if (r)
goto out;

param->data_size = sizeof(*param);
param->data_size = offsetof(struct dm_ioctl, data);
r = fn(param, input_param_size);

if (unlikely(param->flags & DM_BUFFER_FULL_FLAG) &&
Expand Down

0 comments on commit 4617f56

Please sign in to comment.