ACPI / debugfs: Fix buffer overflows, double free

File position is not controlled, it may lead to overwrites of arbitrary kernel memory. Also the code may kfree() the same pointer multiple times. One more flaw is still present: if multiple processes open the file then all 3 static variables are shared, leading to various race conditions. They should be moved to file->private_data. Signed-off-by: Vasiliy Kulikov <segoon@openwall.com> Reviewed-by: WANG Cong <xiyou.wangcong@gmail.com> Reviewed-by: Eugene Teo <eugeneteo@kernel.org> Cc: stable@kernel.org Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>

ACPI / debugfs: Fix buffer overflows, double free
File position is not controlled, it may lead to overwrites of arbitrary kernel memory. Also the code may kfree() the same pointer multiple times. One more flaw is still present: if multiple processes open the file then all 3 static variables are shared, leading to various race conditions. They should be moved to file->private_data. Signed-off-by: Vasiliy Kulikov <segoon@openwall.com> Reviewed-by: WANG Cong <xiyou.wangcong@gmail.com> Reviewed-by: Eugene Teo <eugeneteo@kernel.org> Cc: stable@kernel.org Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
Vasiliy Kulikov · Rafael J. Wysocki
1 parent 2aa15890f3
Showing 1 changed file with 14 additions and 6 deletions Side-by-side Diff
drivers/acpi/debugfs.c
@@ -26,7 +26,9 @@
 			size_t count, loff_t *ppos)
 {
 	static char *buf;
-	static int uncopied_bytes;
+	static u32 max_size;
+	static u32 uncopied_bytes;
+
 	struct acpi_table_header table;
 	acpi_status status;
  
  
  
  
  
@@ -37,19 +39,24 @@
 		if (copy_from_user(&table, user_buf,
 				   sizeof(struct acpi_table_header)))
 			return -EFAULT;
-		uncopied_bytes = table.length;
-		buf = kzalloc(uncopied_bytes, GFP_KERNEL);
+		uncopied_bytes = max_size = table.length;
+		buf = kzalloc(max_size, GFP_KERNEL);
 		if (!buf)
 			return -ENOMEM;
 	}
  
-	if (uncopied_bytes < count) {
-		kfree(buf);
+	if (buf == NULL)
 		return -EINVAL;
-	}
  
+	if ((*ppos > max_size) ||
+	    (*ppos + count > max_size) ||
+	    (*ppos + count < count) ||
+	    (count > uncopied_bytes))
+		return -EINVAL;
+
 	if (copy_from_user(buf + (*ppos), user_buf, count)) {
 		kfree(buf);
+		buf = NULL;
 		return -EFAULT;
 	}
  
@@ -59,6 +66,7 @@
 	if (!uncopied_bytes) {
 		status = acpi_install_method(buf);
 		kfree(buf);
+		buf = NULL;
 		if (ACPI_FAILURE(status))
 			return -EINVAL;
 		add_taint(TAINT_OVERRIDDEN_ACPI_TABLE);
...	...	@@ -26,7 +26,9 @@
26	26	size_t count, loff_t *ppos)
27	27	{
28	28	static char *buf;
29		- static int uncopied_bytes;
	29	+ static u32 max_size;
	30	+ static u32 uncopied_bytes;
	31	+
30	32	struct acpi_table_header table;
31	33	acpi_status status;
32	34
33	35
34	36
35	37
36	38
...	...	@@ -37,19 +39,24 @@
37	39	if (copy_from_user(&table, user_buf,
38	40	sizeof(struct acpi_table_header)))
39	41	return -EFAULT;
40		- uncopied_bytes = table.length;
41		- buf = kzalloc(uncopied_bytes, GFP_KERNEL);
	42	+ uncopied_bytes = max_size = table.length;
	43	+ buf = kzalloc(max_size, GFP_KERNEL);
42	44	if (!buf)
43	45	return -ENOMEM;
44	46	}
45	47
46		- if (uncopied_bytes < count) {
47		- kfree(buf);
	48	+ if (buf == NULL)
48	49	return -EINVAL;
49		- }
50	50
	51	+ if ((*ppos > max_size) \|\|
	52	+ (*ppos + count > max_size) \|\|
	53	+ (*ppos + count < count) \|\|
	54	+ (count > uncopied_bytes))
	55	+ return -EINVAL;
	56	+
51	57	if (copy_from_user(buf + (*ppos), user_buf, count)) {
52	58	kfree(buf);
	59	+ buf = NULL;
53	60	return -EFAULT;
54	61	}
55	62
...	...	@@ -59,6 +66,7 @@
59	66	if (!uncopied_bytes) {
60	67	status = acpi_install_method(buf);
61	68	kfree(buf);
	69	+ buf = NULL;
62	70	if (ACPI_FAILURE(status))
63	71	return -EINVAL;
64	72	add_taint(TAINT_OVERRIDDEN_ACPI_TABLE);