From patchwork Sat Apr 9 14:51:37 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tom Rix X-Patchwork-Id: 12807965 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 77C0CC433F5 for ; Sat, 9 Apr 2022 14:52:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233301AbiDIOyJ (ORCPT ); Sat, 9 Apr 2022 10:54:09 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38234 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233492AbiDIOyI (ORCPT ); Sat, 9 Apr 2022 10:54:08 -0400 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 4DA356341 for ; Sat, 9 Apr 2022 07:51:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1649515918; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=t/bg9kn7ROahCSJyzfOEtwvtDCZszZoWTbNGij2GrjE=; b=WIn2RwJ+6s6g0PgtqNJIaGlqmHd/zV8vIuqysfyp3wN8v4yqTnhbYNl4rxyxsexHjj4rNi ySzlTOcL5FngQ9aRexdNRkDJKcuhIZtcAMyYSMgal9804Ui99LfQeDelaoreM22JsdY4SW EqjbNtmV5HABmQUnNAqtHjLTmKEqvTs= Received: from mail-qt1-f197.google.com (mail-qt1-f197.google.com [209.85.160.197]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-650-IRzvpT_PMVGySR414U9kFw-1; Sat, 09 Apr 2022 10:51:56 -0400 X-MC-Unique: IRzvpT_PMVGySR414U9kFw-1 Received: by mail-qt1-f197.google.com with SMTP id e5-20020ac85985000000b002e217abd72fso9875228qte.9 for ; Sat, 09 Apr 2022 07:51:56 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=t/bg9kn7ROahCSJyzfOEtwvtDCZszZoWTbNGij2GrjE=; b=gNyntsS9t1raiwqE3BSFypGFTWSc/Q5oILULZBM828HyNLuHGyWa6XcGtyGrgnQCgZ G/z7xHiBhbnGDxLKCw/S2C38efNOzd0rYR++bFDGjBif17QTpF4P2/Xzg/woVMPcGMlD w8/EztYnxfxcWpyukTkXtOAgHVGcSbWUsPu6G1MXo1YIhdAIjMp/g6ysLDjjVaIfK49P AjEx0rGRsmds4hdh1NB/JHK+rrTtUk1wkFmql87phiOF7coWrGUI3pnTjzNQfbiLSpjL Vur3cC/riax+zTd8UO7hES/fgLF2h6qQNOqftsAVis+1C8NZ1+FAzNJc20iVE2W0376m +fbA== X-Gm-Message-State: AOAM532ZWlClmgOnAD5yFjfR/l9FGg9nturf7lFjFDc9M4TULzK4pHQp AKmJ19LWvY1raAP4mDLePW8uKTLGYSKWd3FGWaV6b05EpjuqxtO0aJe6TWfU6evLIBO0WPXoMJc kci/qllWNffmb25e2i6eOeA== X-Received: by 2002:a05:620a:2544:b0:680:a53b:ec1a with SMTP id s4-20020a05620a254400b00680a53bec1amr16685991qko.544.1649515916288; Sat, 09 Apr 2022 07:51:56 -0700 (PDT) X-Google-Smtp-Source: ABdhPJwGn6fJ9jRuJMb+wl3Tw8IkHfFNGvG+cEzqACp3UVw8jPRAuuFK+9VOOBkb8ed4Kksz+lzgVw== X-Received: by 2002:a05:620a:2544:b0:680:a53b:ec1a with SMTP id s4-20020a05620a254400b00680a53bec1amr16685978qko.544.1649515916047; Sat, 09 Apr 2022 07:51:56 -0700 (PDT) Received: from dell-per740-01.7a2m.lab.eng.bos.redhat.com (nat-pool-bos-t.redhat.com. [66.187.233.206]) by smtp.gmail.com with ESMTPSA id a23-20020a05620a16d700b0067e98304705sm14845602qkn.89.2022.04.09.07.51.55 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 09 Apr 2022 07:51:55 -0700 (PDT) From: Tom Rix To: tim@cyberelk.net, axboe@kernel.dk, jejb@linux.ibm.com, martin.petersen@oracle.com, nathan@kernel.org, ndesaulniers@google.com Cc: linux-block@vger.kernel.org, linux-kernel@vger.kernel.org, linux-scsi@vger.kernel.org, llvm@lists.linux.dev, Tom Rix Subject: [PATCH] security: do not leak information in ioctl Date: Sat, 9 Apr 2022 10:51:37 -0400 Message-Id: <20220409145137.67592-1-trix@redhat.com> X-Mailer: git-send-email 2.27.0 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-scsi@vger.kernel.org clang static analysis reports this representative issue pcd.c:832:22: warning: Assigned value is garbage or undefined tochdr->cdth_trk0 = buffer[2]; ^ ~~~~~~~~~ If the call to pcd_atapi fails, buffer is an unknown state. Passing an unknown buffer back to the user can leak information and is a security risk. Check before returning this buffer to the user. The per-case variables cmd and buffer are common. Change their scope to function level. Change colliding parameter name cmd to request. Cleanup whitespace pcd.c comment /* the audio_ioctl stuff is adapted from sr_ioctl.c */ Shows there is a similar problem in sr_ioctl.c sr_ioctl.c uses this pattern result = sr_do_ioctl(cd, &cgc); to-user = buffer[]; kfree(buffer); return result; Check result and jump over the use of buffer if there is an error. result = sr_do_ioctl(cd, &cgc); if (result) goto err; to-user = buffer[]; err: kfree(buffer); return result; Additionally initialize the buffer to zero. This problem can be seen in the 2.4.0 kernel However this scm only goes back as far as 2.6.12 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Tom Rix --- drivers/block/paride/pcd.c | 87 +++++++++++++++++--------------------- drivers/scsi/sr_ioctl.c | 15 +++++-- 2 files changed, 50 insertions(+), 52 deletions(-) diff --git a/drivers/block/paride/pcd.c b/drivers/block/paride/pcd.c index f462ad67931a..2315918e3647 100644 --- a/drivers/block/paride/pcd.c +++ b/drivers/block/paride/pcd.c @@ -810,67 +810,56 @@ static void do_pcd_read_drq(void) /* the audio_ioctl stuff is adapted from sr_ioctl.c */ -static int pcd_audio_ioctl(struct cdrom_device_info *cdi, unsigned int cmd, void *arg) +static int pcd_audio_ioctl(struct cdrom_device_info *cdi, unsigned int request, void *arg) { struct pcd_unit *cd = cdi->handle; + char cmd[12] = { GPCMD_READ_TOC_PMA_ATIP, 0, 0, 0, 0, 0, 0, 0, 12, 0, 0, 0 }; + char buffer[32] = {}; - switch (cmd) { - + switch (request) { case CDROMREADTOCHDR: + { + struct cdrom_tochdr *tochdr = + (struct cdrom_tochdr *) arg; - { - char cmd[12] = - { GPCMD_READ_TOC_PMA_ATIP, 0, 0, 0, 0, 0, 0, 0, 12, - 0, 0, 0 }; - struct cdrom_tochdr *tochdr = - (struct cdrom_tochdr *) arg; - char buffer[32]; - int r; - - r = pcd_atapi(cd, cmd, 12, buffer, "read toc header"); + if (pcd_atapi(cd, cmd, 12, buffer, "read toc header")) + return -EIO; - tochdr->cdth_trk0 = buffer[2]; - tochdr->cdth_trk1 = buffer[3]; + tochdr->cdth_trk0 = buffer[2]; + tochdr->cdth_trk1 = buffer[3]; - return r ? -EIO : 0; - } + return 0; + } case CDROMREADTOCENTRY: - - { - char cmd[12] = - { GPCMD_READ_TOC_PMA_ATIP, 0, 0, 0, 0, 0, 0, 0, 12, - 0, 0, 0 }; - - struct cdrom_tocentry *tocentry = - (struct cdrom_tocentry *) arg; - unsigned char buffer[32]; - int r; - - cmd[1] = - (tocentry->cdte_format == CDROM_MSF ? 0x02 : 0); - cmd[6] = tocentry->cdte_track; - - r = pcd_atapi(cd, cmd, 12, buffer, "read toc entry"); - - tocentry->cdte_ctrl = buffer[5] & 0xf; - tocentry->cdte_adr = buffer[5] >> 4; - tocentry->cdte_datamode = - (tocentry->cdte_ctrl & 0x04) ? 1 : 0; - if (tocentry->cdte_format == CDROM_MSF) { - tocentry->cdte_addr.msf.minute = buffer[9]; - tocentry->cdte_addr.msf.second = buffer[10]; - tocentry->cdte_addr.msf.frame = buffer[11]; - } else - tocentry->cdte_addr.lba = - (((((buffer[8] << 8) + buffer[9]) << 8) - + buffer[10]) << 8) + buffer[11]; - - return r ? -EIO : 0; + { + struct cdrom_tocentry *tocentry = + (struct cdrom_tocentry *) arg; + + cmd[1] = (tocentry->cdte_format == CDROM_MSF ? 0x02 : 0); + cmd[6] = tocentry->cdte_track; + + if (pcd_atapi(cd, cmd, 12, buffer, "read toc entry")) + return -EIO; + + tocentry->cdte_ctrl = buffer[5] & 0xf; + tocentry->cdte_adr = buffer[5] >> 4; + tocentry->cdte_datamode = + (tocentry->cdte_ctrl & 0x04) ? 1 : 0; + if (tocentry->cdte_format == CDROM_MSF) { + tocentry->cdte_addr.msf.minute = buffer[9]; + tocentry->cdte_addr.msf.second = buffer[10]; + tocentry->cdte_addr.msf.frame = buffer[11]; + } else { + tocentry->cdte_addr.lba = + (((((buffer[8] << 8) + buffer[9]) << 8) + + buffer[10]) << 8) + buffer[11]; } - default: + return 0; + } + default: return -ENOSYS; } } diff --git a/drivers/scsi/sr_ioctl.c b/drivers/scsi/sr_ioctl.c index ddd00efc4882..fbdb5124d7f7 100644 --- a/drivers/scsi/sr_ioctl.c +++ b/drivers/scsi/sr_ioctl.c @@ -41,7 +41,7 @@ static int sr_read_tochdr(struct cdrom_device_info *cdi, int result; unsigned char *buffer; - buffer = kmalloc(32, GFP_KERNEL); + buffer = kzalloc(32, GFP_KERNEL); if (!buffer) return -ENOMEM; @@ -55,10 +55,13 @@ static int sr_read_tochdr(struct cdrom_device_info *cdi, cgc.data_direction = DMA_FROM_DEVICE; result = sr_do_ioctl(cd, &cgc); + if (result) + goto err; tochdr->cdth_trk0 = buffer[2]; tochdr->cdth_trk1 = buffer[3]; +err: kfree(buffer); return result; } @@ -71,7 +74,7 @@ static int sr_read_tocentry(struct cdrom_device_info *cdi, int result; unsigned char *buffer; - buffer = kmalloc(32, GFP_KERNEL); + buffer = kzalloc(32, GFP_KERNEL); if (!buffer) return -ENOMEM; @@ -86,6 +89,8 @@ static int sr_read_tocentry(struct cdrom_device_info *cdi, cgc.data_direction = DMA_FROM_DEVICE; result = sr_do_ioctl(cd, &cgc); + if (result) + goto err; tocentry->cdte_ctrl = buffer[5] & 0xf; tocentry->cdte_adr = buffer[5] >> 4; @@ -98,6 +103,7 @@ static int sr_read_tocentry(struct cdrom_device_info *cdi, tocentry->cdte_addr.lba = (((((buffer[8] << 8) + buffer[9]) << 8) + buffer[10]) << 8) + buffer[11]; +err: kfree(buffer); return result; } @@ -384,7 +390,7 @@ int sr_get_mcn(struct cdrom_device_info *cdi, struct cdrom_mcn *mcn) { Scsi_CD *cd = cdi->handle; struct packet_command cgc; - char *buffer = kmalloc(32, GFP_KERNEL); + char *buffer = kzalloc(32, GFP_KERNEL); int result; if (!buffer) @@ -400,10 +406,13 @@ int sr_get_mcn(struct cdrom_device_info *cdi, struct cdrom_mcn *mcn) cgc.data_direction = DMA_FROM_DEVICE; cgc.timeout = IOCTL_TIMEOUT; result = sr_do_ioctl(cd, &cgc); + if (result) + goto err; memcpy(mcn->medium_catalog_number, buffer + 9, 13); mcn->medium_catalog_number[13] = 0; +err: kfree(buffer); return result; }