linux/drivers/firewire
Stefan Richter eaca2d8e75 firewire: cdev: prevent kernel stack leaking into ioctl arguments
Found by the UC-KLEE tool:  A user could supply less input to
firewire-cdev ioctls than write- or write/read-type ioctl handlers
expect.  The handlers used data from uninitialized kernel stack then.

This could partially leak back to the user if the kernel subsequently
generated fw_cdev_event_'s (to be read from the firewire-cdev fd)
which notably would contain the _u64 closure field which many of the
ioctl argument structures contain.

The fact that the handlers would act on random garbage input is a
lesser issue since all handlers must check their input anyway.

The fix simply always null-initializes the entire ioctl argument buffer
regardless of the actual length of expected user input.  That is, a
runtime overhead of memset(..., 40) is added to each firewirew-cdev
ioctl() call.  [Comment from Clemens Ladisch:  This part of the stack is
most likely to be already in the cache.]

Remarks:
  - There was never any leak from kernel stack to the ioctl output
    buffer itself.  IOW, it was not possible to read kernel stack by a
    read-type or write/read-type ioctl alone; the leak could at most
    happen in combination with read()ing subsequent event data.
  - The actual expected minimum user input of each ioctl from
    include/uapi/linux/firewire-cdev.h is, in bytes:
    [0x00] = 32, [0x05] =  4, [0x0a] = 16, [0x0f] = 20, [0x14] = 16,
    [0x01] = 36, [0x06] = 20, [0x0b] =  4, [0x10] = 20, [0x15] = 20,
    [0x02] = 20, [0x07] =  4, [0x0c] =  0, [0x11] =  0, [0x16] =  8,
    [0x03] =  4, [0x08] = 24, [0x0d] = 20, [0x12] = 36, [0x17] = 12,
    [0x04] = 20, [0x09] = 24, [0x0e] =  4, [0x13] = 40, [0x18] =  4.

Reported-by: David Ramos <daramos@stanford.edu>
Cc: <stable@vger.kernel.org>
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
2014-11-14 12:10:13 +01:00
..
core-card.c IEEE 1394 (FireWire) subsystem updates post v3.4: 2012-05-24 12:57:47 -07:00
core-cdev.c firewire: cdev: prevent kernel stack leaking into ioctl arguments 2014-11-14 12:10:13 +01:00
core-device.c firewire: don't use PREPARE_DELAYED_WORK 2014-03-07 10:19:57 -05:00
core-iso.c firewire: core: fix multichannel IR with buffers larger than 2 GB 2012-06-17 19:35:26 +02:00
core-topology.c Remove all #inclusions of asm/system.h 2012-03-28 18:30:03 +01:00
core-transaction.c firewire: Enable remote DMA above 4 GB 2014-01-20 01:11:13 +01:00
core.h sound updates for 3.16-rc1 2014-06-04 09:08:25 -07:00
init_ohci1394_dma.c various: Fix spelling of "asynchronous" in comments. 2012-11-19 14:32:13 +01:00
Kconfig firewire: IEEE 1394 (FireWire) support should depend on HAS_DMA 2014-07-13 20:53:25 +02:00
Makefile ieee1394: move init_ohci1394_dma to drivers/firewire/ 2010-10-11 14:48:03 +02:00
net.c net: set name_assign_type in alloc_netdev() 2014-07-15 16:12:48 -07:00
nosy-user.h firewire: nosy: endianess fixes and annotations 2010-07-27 11:04:11 +02:00
nosy.c firewire: remove use of __devinitdata 2012-11-28 12:40:42 -08:00
nosy.h firewire: nosy: misc cleanups 2010-07-27 11:04:10 +02:00
ohci.c IEEE 1394 (FireWire) subsystem fix: MSI don't work on VIA PCIe controllers 2014-07-27 09:42:06 -07:00
ohci.h firewire: ohci: fix TI TSB82AA2 regression since 2.6.35 2010-10-17 14:09:12 +02:00
sbp2.c firewire: don't use PREPARE_DELAYED_WORK 2014-03-07 10:19:57 -05:00