From patchwork Tue Jul 3 06:45:15 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ian Kent X-Patchwork-Id: 10503161 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 2775A60225 for ; Tue, 3 Jul 2018 06:45:35 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 16C6B2855C for ; Tue, 3 Jul 2018 06:45:35 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 08C8A28A10; Tue, 3 Jul 2018 06:45:35 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00, MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id A3C7728A0D for ; Tue, 3 Jul 2018 06:45:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753752AbeGCGpU (ORCPT ); Tue, 3 Jul 2018 02:45:20 -0400 Received: from icp-osb-irony-out2.external.iinet.net.au ([203.59.1.155]:36218 "EHLO icp-osb-irony-out2.external.iinet.net.au" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753213AbeGCGpT (ORCPT ); Tue, 3 Jul 2018 02:45:19 -0400 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A2AYAwA8Gjtb/1SrLHlcg3qBTxIog3mUR?= =?us-ascii?q?UkBAQEBAQEGgRA1iB2EKYhOgXoeGAGEQIM7ITQYAQIBAQEBAQECbSiFYARSKAE?= =?us-ascii?q?MAhgOAiMmFhOFCAMIDKkWgWkzGgKGew2BLoE6gQuHYoEOgQeBQoUyhSWCVQKMT?= =?us-ascii?q?jsti2UrCYwSgwuBQIZlAw+FHgErileIRjiBUk0uCoMkkF8yMHoBAY0iK4IbAQE?= X-IPAS-Result: =?us-ascii?q?A2AYAwA8Gjtb/1SrLHlcg3qBTxIog3mURUkBAQEBAQEGgRA?= =?us-ascii?q?1iB2EKYhOgXoeGAGEQIM7ITQYAQIBAQEBAQECbSiFYARSKAEMAhgOAiMmFhOFC?= =?us-ascii?q?AMIDKkWgWkzGgKGew2BLoE6gQuHYoEOgQeBQoUyhSWCVQKMTjsti2UrCYwSgwu?= =?us-ascii?q?BQIZlAw+FHgErileIRjiBUk0uCoMkkF8yMHoBAY0iK4IbAQE?= X-IronPort-AV: E=Sophos;i="5.51,302,1526313600"; d="scan'208";a="122265891" Received: from unknown (HELO pluto.themaw.net) ([121.44.171.84]) by icp-osb-irony-out2.iinet.net.au with ESMTP; 03 Jul 2018 14:45:16 +0800 Subject: [PATCH] autofs - fix slab out of bounds read in getname_kernel() From: Ian Kent To: Andrew Morton Cc: linux-fsdevel , Tomas Bortoli , autofs mailing list , Kernel Mailing List , Dmitry Vyukov Date: Tue, 03 Jul 2018 14:45:15 +0800 Message-ID: <153060031527.26631.18306637892746301555.stgit@pluto.themaw.net> User-Agent: StGit/0.17.1-dirty MIME-Version: 1.0 Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Initial patch contributed by Tomas Bortoli. The autofs subsystem does not check that the "path" parameter is present for all cases where it is required when it is passed in via the "param" struct. In particular it isn't checked for the AUTOFS_DEV_IOCTL_OPENMOUNT_CMD ioctl command. To solve it, modify validate_dev_ioctl() function to check that a path has been provided for ioctl commands that require it. Signed-off-by: Tomas Bortoli Signed-off-by: Ian Kent Reported-by: syzbot+60c837b428dc84e83a93@syzkaller.appspotmail.com --- fs/autofs/dev-ioctl.c | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/fs/autofs/dev-ioctl.c b/fs/autofs/dev-ioctl.c index ea4ca1445ab7..86eafda4a652 100644 --- a/fs/autofs/dev-ioctl.c +++ b/fs/autofs/dev-ioctl.c @@ -135,6 +135,15 @@ static int validate_dev_ioctl(int cmd, struct autofs_dev_ioctl *param) cmd); goto out; } + } else { + unsigned int inr = _IOC_NR(cmd); + + if (inr == AUTOFS_DEV_IOCTL_OPENMOUNT_CMD || + inr == AUTOFS_DEV_IOCTL_REQUESTER_CMD || + inr == AUTOFS_DEV_IOCTL_ISMOUNTPOINT_CMD) { + err = -EINVAL; + goto out; + } } err = 0; @@ -271,7 +280,8 @@ static int autofs_dev_ioctl_openmount(struct file *fp, dev_t devid; int err, fd; - /* param->path has already been checked */ + /* param->path has been checked in validate_dev_ioctl() */ + if (!param->openmount.devid) return -EINVAL; @@ -433,10 +443,7 @@ static int autofs_dev_ioctl_requester(struct file *fp, dev_t devid; int err = -ENOENT; - if (param->size <= AUTOFS_DEV_IOCTL_SIZE) { - err = -EINVAL; - goto out; - } + /* param->path has been checked in validate_dev_ioctl() */ devid = sbi->sb->s_dev; @@ -521,10 +528,7 @@ static int autofs_dev_ioctl_ismountpoint(struct file *fp, unsigned int devid, magic; int err = -ENOENT; - if (param->size <= AUTOFS_DEV_IOCTL_SIZE) { - err = -EINVAL; - goto out; - } + /* param->path has been checked in validate_dev_ioctl() */ name = param->path; type = param->ismountpoint.in.type;