From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: ARC-Seal: i=1; a=rsa-sha256; t=1525788480; cv=none; d=google.com; s=arc-20160816; b=SxdEo4rFXjaDWV66EvLDfR/uO22R6LDMY49Yi8Gr8KmZsCCo5/szP1B3mL/GGoTYLC DSvBuJS01Ea+OfYT5KszePO+7RRBlLgLFxnd6QzMeQnFRgwBU1wNOCDcHELJREmFvYU2 eNblFTeiPzWefOIG/Tkdc7roRJkNrzhu5Wciu4EKOvQEPhYZGZTbzjhKFJmNZNSxgtfG 7FvO0/E4wL11Re3N92zHa0s0t4IMedjJ+YNRejHnawplui+DYhfm7QhDmqYbNW2wkSHP f52JQqzl86vkqfl560ikFpXQdG+u7maUhpFpQD4t7CBa/I4EWlUVvxJ1961ngq5k5jdI /mPA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:content-language:in-reply-to:mime-version :user-agent:date:message-id:from:references:cc:to:subject :arc-authentication-results; bh=i4KH/UVZWCLXsq3Pd9MuQ5pTrNUW3/+KjD/jo9B7pj4=; b=RRis2kW20JEA7NMu30bgASLTbHAYrXXpOMRzSd7ur22+tP5XdmbJbb3F0hFmfYI7KI 7d0/38TG3RszH6fH0FYMZhbYEdaqucZA+zGEGiYFuGb02JAldr/xyCYEc0s/5jkXpXrF U/bqaiDAWMhxcPZDS1+jhQTPkD29FVkzU7CMKLel3pvcW5rmnGj3XKGVkkTIPpiK35Nj 1Eq2rYwT3zsxYlwI1fR61HtEdf1LgQBMJJ1lfEyuvktG/b7zGqBsBBl9JJTNWJ7w9mj5 9cHpspfgZABzpVqrk3yaGjEDgGe5pS5G95Rd0feIe6vIjh9mfwVwljOnp/1a7xxTB8Dm KREg== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of hdegoede@redhat.com designates 209.85.220.65 as permitted sender) smtp.mailfrom=hdegoede@redhat.com; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com Authentication-Results: mx.google.com; spf=pass (google.com: domain of hdegoede@redhat.com designates 209.85.220.65 as permitted sender) smtp.mailfrom=hdegoede@redhat.com; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com X-Google-Smtp-Source: AB8JxZqJYAxfKvsVDsOFVZDcBAgyZ/Forgw4QJVEimEwIrMRceuo1oae0swHoccUHU8IG+BQ7YerUw== Subject: Re: [PATCH] virt: vbox: Only copy_from_user the request-header once To: Arnd Bergmann , Greg Kroah-Hartman Cc: linux-kernel@vger.kernel.org References: <20180508134659.20429-1-hdegoede@redhat.com> From: Hans de Goede Message-ID: <456c3863-7da9-0b73-144f-dc73582d91c8@redhat.com> Date: Tue, 8 May 2018 16:07:58 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.7.0 MIME-Version: 1.0 In-Reply-To: <20180508134659.20429-1-hdegoede@redhat.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: =?utf-8?q?1599903862223465156?= X-GMAIL-MSGID: =?utf-8?q?1599905182122381293?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: Hi, On 08-05-18 15:46, Hans de Goede wrote: > In vbg_misc_device_ioctl(), the header of the ioctl argument is copied from > the userspace pointer 'arg' and saved to the kernel object 'hdr'. Then the > 'version', 'size_in', and 'size_out' fields of 'hdr' are verified. > > Before this commit, after the checks a buffer for the entire request would > be allocated and then all data including the verified header would be > copied from the userspace 'arg' pointer again. > > Given that the 'arg' pointer resides in userspace, a malicious userspace > process can race to change the data pointed to by 'arg' between the two > copies. By doing so, the user can bypass the verifications on the ioctl > argument. > > This commit fixes this by using the already checked copy of the header > to fill the header part of the allocated buffer and only copying the > remainder of the data from userspace. > > Reported-by: Wenwen Wang > Signed-off-by: Hans de Goede Wenwen just send a v2 of his patch, lets go with his (identical) version as he has done the hard work of tracking this down. Regards, Hans > --- > drivers/virt/vboxguest/vboxguest_linux.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/drivers/virt/vboxguest/vboxguest_linux.c b/drivers/virt/vboxguest/vboxguest_linux.c > index 398d22693234..6e2a9619192d 100644 > --- a/drivers/virt/vboxguest/vboxguest_linux.c > +++ b/drivers/virt/vboxguest/vboxguest_linux.c > @@ -121,7 +121,9 @@ static long vbg_misc_device_ioctl(struct file *filp, unsigned int req, > if (!buf) > return -ENOMEM; > > - if (copy_from_user(buf, (void *)arg, hdr.size_in)) { > + *((struct vbg_ioctl_hdr *)buf) = hdr; > + if (copy_from_user(buf + sizeof(hdr), (void *)arg + sizeof(hdr), > + hdr.size_in - sizeof(hdr))) { > ret = -EFAULT; > goto out; > } >