kernel-fxtec-pro1x/arch/alpha
Mathieu Desnoyers 3ddc5b46a8 kernel-wide: fix missing validations on __get/__put/__copy_to/__copy_from_user()
I found the following pattern that leads in to interesting findings:

  grep -r "ret.*|=.*__put_user" *
  grep -r "ret.*|=.*__get_user" *
  grep -r "ret.*|=.*__copy" *

The __put_user() calls in compat_ioctl.c, ptrace compat, signal compat,
since those appear in compat code, we could probably expect the kernel
addresses not to be reachable in the lower 32-bit range, so I think they
might not be exploitable.

For the "__get_user" cases, I don't think those are exploitable: the worse
that can happen is that the kernel will copy kernel memory into in-kernel
buffers, and will fail immediately afterward.

The alpha csum_partial_copy_from_user() seems to be missing the
access_ok() check entirely.  The fix is inspired from x86.  This could
lead to information leak on alpha.  I also noticed that many architectures
map csum_partial_copy_from_user() to csum_partial_copy_generic(), but I
wonder if the latter is performing the access checks on every
architectures.

Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Richard Henderson <rth@twiddle.net>
Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
Cc: Matt Turner <mattst88@gmail.com>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: David Miller <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2013-09-11 15:58:18 -07:00
..
boot alpha: boot: fix build breakage introduced by system.h disintegration 2013-03-08 15:05:34 -08:00
include alpha: Force the user-visible HZ to a constant 1024. 2013-07-19 13:54:26 -07:00
kernel alpha: Use handle_percpu_irq for the timer interrupt 2013-07-19 13:54:26 -07:00
lib kernel-wide: fix missing validations on __get/__put/__copy_to/__copy_from_user() 2013-09-11 15:58:18 -07:00
math-emu alpha: change to new Makefile flag variables 2011-01-17 05:42:13 +01:00
mm mm/alpha: unify mem_init() for both UMA and NUMA architectures 2013-07-03 16:07:39 -07:00
oprofile oprofilefs_create_...() do not need superblock argument 2013-09-03 22:52:48 -04:00
defconfig defconfig reduction 2010-08-14 22:26:53 +02:00
Kconfig alpha: Implement atomic64_dec_if_positive 2013-07-19 13:54:24 -07:00
Kconfig.debug alpha/parisc: remove config variable DEBUG_RWLOCK 2008-02-06 10:41:03 -08:00
Makefile alpha: makefile: don't enforce small data model for kernel builds 2013-04-07 12:59:30 -07:00