linux-sg2042/drivers/firewire
Stefan Richter 790198f74c firewire: cdev: fix user memory corruption (i386 userland on amd64 kernel)
Fix two bugs of the /dev/fw* character device concerning the
FW_CDEV_IOC_GET_INFO ioctl with nonzero fw_cdev_get_info.bus_reset.
(Practically all /dev/fw* clients issue this ioctl right after opening
the device.)

Both bugs are caused by sizeof(struct fw_cdev_event_bus_reset) being 36
without natural alignment and 40 with natural alignment.

 1) Memory corruption, affecting i386 userland on amd64 kernel:
    Userland reserves a 36 bytes large buffer, kernel writes 40 bytes.
    This has been first found and reported against libraw1394 if
    compiled with gcc 4.7 which happens to order libraw1394's stack such
    that the bug became visible as data corruption.

 2) Information leak, affecting all kernel architectures except i386:
    4 bytes of random kernel stack data were leaked to userspace.

Hence limit the respective copy_to_user() to the 32-bit aligned size of
struct fw_cdev_event_bus_reset.

Reported-by: Simon Kirby <sim@hostway.ca>
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
Cc: stable@kernel.org
2012-10-09 18:26:28 +02:00
..
Kconfig firewire: ohci: move runtime debug facility out of #ifdef 2012-03-10 17:41:19 +01:00
Makefile ieee1394: move init_ohci1394_dma to drivers/firewire/ 2010-10-11 14:48:03 +02:00
core-card.c IEEE 1394 (FireWire) subsystem updates post v3.4: 2012-05-24 12:57:47 -07:00
core-cdev.c firewire: cdev: fix user memory corruption (i386 userland on amd64 kernel) 2012-10-09 18:26:28 +02:00
core-device.c firewire: core: feed /dev/random with devices' GUIDs 2012-09-25 16:18:17 +02:00
core-iso.c firewire: core: fix multichannel IR with buffers larger than 2 GB 2012-06-17 19:35:26 +02:00
core-topology.c Remove all #inclusions of asm/system.h 2012-03-28 18:30:03 +01:00
core-transaction.c firewire: addendum to address handler RCU conversion 2012-09-28 11:47:42 +02:00
core.h IEEE 1394 (FireWire) subsystem updates post v3.4: 2012-05-24 12:57:47 -07:00
init_ohci1394_dma.c ieee1394: move init_ohci1394_dma to drivers/firewire/ 2010-10-11 14:48:03 +02:00
net.c firewire: net: use dev_printk API 2012-02-22 22:36:00 +01:00
nosy-user.h firewire: nosy: endianess fixes and annotations 2010-07-27 11:04:11 +02:00
nosy.c firewire: use module_pci_driver 2012-04-09 14:23:37 +02:00
nosy.h firewire: nosy: misc cleanups 2010-07-27 11:04:10 +02:00
ohci.c firewire: ohci: get IR bit from TSB41BA3D phy 2012-09-25 16:18:17 +02:00
ohci.h firewire: ohci: fix TI TSB82AA2 regression since 2.6.35 2010-10-17 14:09:12 +02:00
sbp2.c firewire: sbp2: document the absence of alignment requirements 2012-05-21 21:49:44 +02:00