A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-08 12:58:12 -04:00
Code Issues Projects Releases Packages Wiki Activity
No description
898,102 commits 10 branches 0 tags 2.1 GiB
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Lin Ma 161d4509dd scsi: iscsi: Add strlen() check in iscsi_if_set{_host}_param() 
[ Upstream commit ce51c817008450ef4188471db31639d42d37a5e1 ]

The functions iscsi_if_set_param() and iscsi_if_set_host_param() convert an
nlattr payload to type char* and then call C string handling functions like
sscanf and kstrdup:

  char *data = (char*)ev + sizeof(*ev);
  ...
  sscanf(data, "%d", &value);

However, since the nlattr is provided by the user-space program and the
nlmsg skb is allocated with GFP_KERNEL instead of GFP_ZERO flag (see
netlink_alloc_large_skb() in netlink_sendmsg()), dirty data on the heap can
lead to an OOB access for those string handling functions.

By investigating how the bug is introduced, we find it is really
interesting as the old version parsing code starting from commit
fd7255f51a ("[SCSI] iscsi: add sysfs attrs for uspace sync up") treated
the nlattr as integer bytes instead of string and had length check in
iscsi_copy_param():

  if (ev->u.set_param.len != sizeof(uint32_t))
    BUG();

But, since the commit a54a52caad ("[SCSI] iscsi: fixup set/get param
functions"), the code treated the nlattr as C string while forgetting to
add any strlen checks(), opening the possibility of an OOB access.

Fix the potential OOB by adding the strlen() check before accessing the
buf. If the data passes this check, all low-level set_param handlers can
safely treat this buf as legal C string.

Fixes: fd7255f51a ("[SCSI] iscsi: add sysfs attrs for uspace sync up")
Fixes: 1d9bf13a9c ("[SCSI] iscsi class: add iscsi host set param event")
Signed-off-by: Lin Ma <linma@zju.edu.cn>
Link: https://lore.kernel.org/r/20230723075820.3713119-1-linma@zju.edu.cn
Reviewed-by: Chris Leech <cleech@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-09-23 10:59:49 +02:00
arch powerpc/iommu: Fix notifiers being shared by PCI and VIO buses 2023-09-23 10:59:48 +02:00
block
certs
crypto
Documentation Documentation/sysctl: document page_lock_unfairness 2023-08-30 16:27:27 +02:00
drivers scsi: iscsi: Add strlen() check in iscsi_if_set{_host}_param() 2023-09-23 10:59:49 +02:00
fs NFS: Guard against READDIR loop when entry names exceed MAXNAMELEN 2023-09-23 10:59:48 +02:00
include PCI: Add #defines for Enter Compliance, Transmit Margin 2023-09-23 10:59:47 +02:00
init x86/mm: Initialize text poking earlier 2023-08-08 19:56:36 +02:00
ipc
kernel audit: fix possible soft lockup in __audit_inode_child() 2023-09-23 10:59:46 +02:00
lib radix tree: remove unused variable 2023-08-30 16:27:26 +02:00
LICENSES
mm tmpfs: verify {g,u}id mount options correctly 2023-09-23 10:59:40 +02:00
net netrom: Deny concurrent connect(). 2023-09-23 10:59:43 +02:00
samples
scripts
security smackfs: Prevent underflow in smk_set_cipso() 2023-09-23 10:59:46 +02:00
sound ALSA: ac97: Fix possible error value of *rac97 2023-09-23 10:59:46 +02:00
tools selftests: mirror_gre_changes: Tighten up the TTL test match 2023-08-30 16:27:16 +02:00
usr
virt
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS iio: stx104: Move to addac subdirectory 2023-08-30 16:27:12 +02:00
Makefile Linux 5.4.256 2023-09-02 09:19:19 +02:00
README

README 

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.