summaryrefslogtreecommitdiff
path: root/drivers/base
diff options
context:
space:
mode:
authorEric Biggers <ebiggers@google.com>2020-03-08 05:38:49 +0300
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2020-03-24 15:27:16 +0300
commita65cab7d7f05c2061a3e2490257d3086ff3202c6 (patch)
tree897fff31b7feb585234c26ed50745dbc5cba7e69 /drivers/base
parent4dbe191c046e71d6ea1ba85365ecb33961b07c4f (diff)
downloadlinux-a65cab7d7f05c2061a3e2490257d3086ff3202c6.tar.xz
libfs: fix infoleak in simple_attr_read()
Reading from a debugfs file at a nonzero position, without first reading at position 0, leaks uninitialized memory to userspace. It's a bit tricky to do this, since lseek() and pread() aren't allowed on these files, and write() doesn't update the position on them. But writing to them with splice() *does* update the position: #define _GNU_SOURCE 1 #include <fcntl.h> #include <stdio.h> #include <unistd.h> int main() { int pipes[2], fd, n, i; char buf[32]; pipe(pipes); write(pipes[1], "0", 1); fd = open("/sys/kernel/debug/fault_around_bytes", O_RDWR); splice(pipes[0], NULL, fd, NULL, 1, 0); n = read(fd, buf, sizeof(buf)); for (i = 0; i < n; i++) printf("%02x", buf[i]); printf("\n"); } Output: 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a30 Fix the infoleak by making simple_attr_read() always fill simple_attr::get_buf if it hasn't been filled yet. Reported-by: syzbot+fcab69d1ada3e8d6f06b@syzkaller.appspotmail.com Reported-by: Alexander Potapenko <glider@google.com> Fixes: acaefc25d21f ("[PATCH] libfs: add simple attribute files") Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers <ebiggers@google.com> Acked-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20200308023849.988264-1-ebiggers@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/base')
0 files changed, 0 insertions, 0 deletions