168 lines
6.2 KiB
Diff
168 lines
6.2 KiB
Diff
From 6c7e3c3382670fe98debedf2ddaff8abf2944bb4 Mon Sep 17 00:00:00 2001
|
|
From: Mathias Krause <minipli@googlemail.com>
|
|
Date: Mon, 30 Sep 2013 22:03:06 +0200
|
|
Subject: proc connector: fix info leaks
|
|
|
|
From: Mathias Krause <minipli@googlemail.com>
|
|
|
|
[ Upstream commit e727ca82e0e9616ab4844301e6bae60ca7327682 ]
|
|
|
|
Initialize event_data for all possible message types to prevent leaking
|
|
kernel stack contents to userland (up to 20 bytes). Also set the flags
|
|
member of the connector message to 0 to prevent leaking two more stack
|
|
bytes this way.
|
|
|
|
Signed-off-by: Mathias Krause <minipli@googlemail.com>
|
|
Signed-off-by: David S. Miller <davem@davemloft.net>
|
|
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
---
|
|
drivers/connector/cn_proc.c | 18 ++++++++++++++++++
|
|
1 file changed, 18 insertions(+)
|
|
|
|
--- a/drivers/connector/cn_proc.c
|
|
+++ b/drivers/connector/cn_proc.c
|
|
@@ -65,6 +65,7 @@ void proc_fork_connector(struct task_str
|
|
|
|
msg = (struct cn_msg *)buffer;
|
|
ev = (struct proc_event *)msg->data;
|
|
+ memset(&ev->event_data, 0, sizeof(ev->event_data));
|
|
get_seq(&msg->seq, &ev->cpu);
|
|
ktime_get_ts(&ts); /* get high res monotonic timestamp */
|
|
put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
|
|
@@ -80,6 +81,7 @@ void proc_fork_connector(struct task_str
|
|
memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
|
|
msg->ack = 0; /* not used */
|
|
msg->len = sizeof(*ev);
|
|
+ msg->flags = 0; /* not used */
|
|
/* If cn_netlink_send() failed, the data is not sent */
|
|
cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
|
|
}
|
|
@@ -96,6 +98,7 @@ void proc_exec_connector(struct task_str
|
|
|
|
msg = (struct cn_msg *)buffer;
|
|
ev = (struct proc_event *)msg->data;
|
|
+ memset(&ev->event_data, 0, sizeof(ev->event_data));
|
|
get_seq(&msg->seq, &ev->cpu);
|
|
ktime_get_ts(&ts); /* get high res monotonic timestamp */
|
|
put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
|
|
@@ -106,6 +109,7 @@ void proc_exec_connector(struct task_str
|
|
memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
|
|
msg->ack = 0; /* not used */
|
|
msg->len = sizeof(*ev);
|
|
+ msg->flags = 0; /* not used */
|
|
cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
|
|
}
|
|
|
|
@@ -122,6 +126,7 @@ void proc_id_connector(struct task_struc
|
|
|
|
msg = (struct cn_msg *)buffer;
|
|
ev = (struct proc_event *)msg->data;
|
|
+ memset(&ev->event_data, 0, sizeof(ev->event_data));
|
|
ev->what = which_id;
|
|
ev->event_data.id.process_pid = task->pid;
|
|
ev->event_data.id.process_tgid = task->tgid;
|
|
@@ -145,6 +150,7 @@ void proc_id_connector(struct task_struc
|
|
memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
|
|
msg->ack = 0; /* not used */
|
|
msg->len = sizeof(*ev);
|
|
+ msg->flags = 0; /* not used */
|
|
cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
|
|
}
|
|
|
|
@@ -160,6 +166,7 @@ void proc_sid_connector(struct task_stru
|
|
|
|
msg = (struct cn_msg *)buffer;
|
|
ev = (struct proc_event *)msg->data;
|
|
+ memset(&ev->event_data, 0, sizeof(ev->event_data));
|
|
get_seq(&msg->seq, &ev->cpu);
|
|
ktime_get_ts(&ts); /* get high res monotonic timestamp */
|
|
put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
|
|
@@ -170,6 +177,7 @@ void proc_sid_connector(struct task_stru
|
|
memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
|
|
msg->ack = 0; /* not used */
|
|
msg->len = sizeof(*ev);
|
|
+ msg->flags = 0; /* not used */
|
|
cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
|
|
}
|
|
|
|
@@ -185,6 +193,7 @@ void proc_ptrace_connector(struct task_s
|
|
|
|
msg = (struct cn_msg *)buffer;
|
|
ev = (struct proc_event *)msg->data;
|
|
+ memset(&ev->event_data, 0, sizeof(ev->event_data));
|
|
get_seq(&msg->seq, &ev->cpu);
|
|
ktime_get_ts(&ts); /* get high res monotonic timestamp */
|
|
put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
|
|
@@ -203,6 +212,7 @@ void proc_ptrace_connector(struct task_s
|
|
memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
|
|
msg->ack = 0; /* not used */
|
|
msg->len = sizeof(*ev);
|
|
+ msg->flags = 0; /* not used */
|
|
cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
|
|
}
|
|
|
|
@@ -218,6 +228,7 @@ void proc_comm_connector(struct task_str
|
|
|
|
msg = (struct cn_msg *)buffer;
|
|
ev = (struct proc_event *)msg->data;
|
|
+ memset(&ev->event_data, 0, sizeof(ev->event_data));
|
|
get_seq(&msg->seq, &ev->cpu);
|
|
ktime_get_ts(&ts); /* get high res monotonic timestamp */
|
|
put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
|
|
@@ -229,6 +240,7 @@ void proc_comm_connector(struct task_str
|
|
memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
|
|
msg->ack = 0; /* not used */
|
|
msg->len = sizeof(*ev);
|
|
+ msg->flags = 0; /* not used */
|
|
cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
|
|
}
|
|
|
|
@@ -244,6 +256,7 @@ void proc_coredump_connector(struct task
|
|
|
|
msg = (struct cn_msg *)buffer;
|
|
ev = (struct proc_event *)msg->data;
|
|
+ memset(&ev->event_data, 0, sizeof(ev->event_data));
|
|
get_seq(&msg->seq, &ev->cpu);
|
|
ktime_get_ts(&ts); /* get high res monotonic timestamp */
|
|
put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
|
|
@@ -254,6 +267,7 @@ void proc_coredump_connector(struct task
|
|
memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
|
|
msg->ack = 0; /* not used */
|
|
msg->len = sizeof(*ev);
|
|
+ msg->flags = 0; /* not used */
|
|
cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
|
|
}
|
|
|
|
@@ -269,6 +283,7 @@ void proc_exit_connector(struct task_str
|
|
|
|
msg = (struct cn_msg *)buffer;
|
|
ev = (struct proc_event *)msg->data;
|
|
+ memset(&ev->event_data, 0, sizeof(ev->event_data));
|
|
get_seq(&msg->seq, &ev->cpu);
|
|
ktime_get_ts(&ts); /* get high res monotonic timestamp */
|
|
put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
|
|
@@ -281,6 +296,7 @@ void proc_exit_connector(struct task_str
|
|
memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
|
|
msg->ack = 0; /* not used */
|
|
msg->len = sizeof(*ev);
|
|
+ msg->flags = 0; /* not used */
|
|
cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
|
|
}
|
|
|
|
@@ -304,6 +320,7 @@ static void cn_proc_ack(int err, int rcv
|
|
|
|
msg = (struct cn_msg *)buffer;
|
|
ev = (struct proc_event *)msg->data;
|
|
+ memset(&ev->event_data, 0, sizeof(ev->event_data));
|
|
msg->seq = rcvd_seq;
|
|
ktime_get_ts(&ts); /* get high res monotonic timestamp */
|
|
put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
|
|
@@ -313,6 +330,7 @@ static void cn_proc_ack(int err, int rcv
|
|
memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
|
|
msg->ack = rcvd_ack + 1;
|
|
msg->len = sizeof(*ev);
|
|
+ msg->flags = 0; /* not used */
|
|
cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
|
|
}
|
|
|