mirror of
https://github.com/followmsi/android_kernel_google_msm.git
synced 2024-11-06 23:17:41 +00:00
5a27d69874
commit 4e9b45a192 upstream.
On 64 bit systems the test for negative message sizes is bogus as the
size, which may be positive when evaluated as a long, will get truncated
to an int when passed to load_msg(). So a long might very well contain a
positive value but when truncated to an int it would become negative.
That in combination with a small negative value of msg_ctlmax (which will
be promoted to an unsigned type for the comparison against msgsz, making
it a big positive value and therefore make it pass the check) will lead to
two problems: 1/ The kmalloc() call in alloc_msg() will allocate a too
small buffer as the addition of alen is effectively a subtraction. 2/ The
copy_from_user() call in load_msg() will first overflow the buffer with
userland data and then, when the userland access generates an access
violation, the fixup handler copy_user_handle_tail() will try to fill the
remainder with zeros -- roughly 4GB. That almost instantly results in a
system crash or reset.
,-[ Reproducer (needs to be run as root) ]--
| #include <sys/stat.h>
| #include <sys/msg.h>
| #include <unistd.h>
| #include <fcntl.h>
|
| int main(void) {
| long msg = 1;
| int fd;
|
| fd = open("/proc/sys/kernel/msgmax", O_WRONLY);
| write(fd, "-1", 2);
| close(fd);
|
| msgsnd(0, &msg, 0xfffffff0, IPC_NOWAIT);
|
| return 0;
| }
'---
Fix the issue by preventing msgsz from getting truncated by consistently
using size_t for the message length. This way the size checks in
do_msgsnd() could still be passed with a negative value for msg_ctlmax but
we would fail on the buffer allocation in that case and error out.
Also change the type of m_ts from int to size_t to avoid similar nastiness
in other code paths -- it is used in similar constructs, i.e. signed vs.
unsigned checks. It should never become negative under normal
circumstances, though.
Setting msg_ctlmax to a negative value is an odd configuration and should
be prevented. As that might break existing userland, it will be handled
in a separate commit so it could easily be reverted and reworked without
reintroducing the above described bug.
Hardening mechanisms for user copy operations would have catched that bug
early -- e.g. checking slab object sizes on user copy operations as the
usercopy feature of the PaX patch does. Or, for that matter, detect the
long vs. int sign change due to truncation, as the size overflow plugin
of the very same patch does.
[akpm@linux-foundation.org: fix i386 min() warnings]
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Pax Team <pageexec@freemail.hu>
Cc: Davidlohr Bueso <davidlohr@hp.com>
Cc: Brad Spengler <spender@grsecurity.net>
Cc: Manfred Spraul <manfred@colorfullife.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[bwh: Backported to 3.2:
- Adjust context
- Drop changes to alloc_msg() and copy_msg(), which don't exist]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Qiang Huang <h.huangqiang@huawei.com>
Cc: Li Zefan <lizefan@huawei.com>
Cc: Jianguo Wu <wujianguo@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
112 lines
3.6 KiB
C
112 lines
3.6 KiB
C
#ifndef _LINUX_MSG_H
|
|
#define _LINUX_MSG_H
|
|
|
|
#include <linux/ipc.h>
|
|
|
|
/* ipcs ctl commands */
|
|
#define MSG_STAT 11
|
|
#define MSG_INFO 12
|
|
|
|
/* msgrcv options */
|
|
#define MSG_NOERROR 010000 /* no error if message is too big */
|
|
#define MSG_EXCEPT 020000 /* recv any msg except of specified type.*/
|
|
|
|
/* Obsolete, used only for backwards compatibility and libc5 compiles */
|
|
struct msqid_ds {
|
|
struct ipc_perm msg_perm;
|
|
struct msg *msg_first; /* first message on queue,unused */
|
|
struct msg *msg_last; /* last message in queue,unused */
|
|
__kernel_time_t msg_stime; /* last msgsnd time */
|
|
__kernel_time_t msg_rtime; /* last msgrcv time */
|
|
__kernel_time_t msg_ctime; /* last change time */
|
|
unsigned long msg_lcbytes; /* Reuse junk fields for 32 bit */
|
|
unsigned long msg_lqbytes; /* ditto */
|
|
unsigned short msg_cbytes; /* current number of bytes on queue */
|
|
unsigned short msg_qnum; /* number of messages in queue */
|
|
unsigned short msg_qbytes; /* max number of bytes on queue */
|
|
__kernel_ipc_pid_t msg_lspid; /* pid of last msgsnd */
|
|
__kernel_ipc_pid_t msg_lrpid; /* last receive pid */
|
|
};
|
|
|
|
/* Include the definition of msqid64_ds */
|
|
#include <asm/msgbuf.h>
|
|
|
|
/* message buffer for msgsnd and msgrcv calls */
|
|
struct msgbuf {
|
|
long mtype; /* type of message */
|
|
char mtext[1]; /* message text */
|
|
};
|
|
|
|
/* buffer for msgctl calls IPC_INFO, MSG_INFO */
|
|
struct msginfo {
|
|
int msgpool;
|
|
int msgmap;
|
|
int msgmax;
|
|
int msgmnb;
|
|
int msgmni;
|
|
int msgssz;
|
|
int msgtql;
|
|
unsigned short msgseg;
|
|
};
|
|
|
|
/*
|
|
* Scaling factor to compute msgmni:
|
|
* the memory dedicated to msg queues (msgmni * msgmnb) should occupy
|
|
* at most 1/MSG_MEM_SCALE of the lowmem (see the formula in ipc/msg.c):
|
|
* up to 8MB : msgmni = 16 (MSGMNI)
|
|
* 4 GB : msgmni = 8K
|
|
* more than 16 GB : msgmni = 32K (IPCMNI)
|
|
*/
|
|
#define MSG_MEM_SCALE 32
|
|
|
|
#define MSGMNI 16 /* <= IPCMNI */ /* max # of msg queue identifiers */
|
|
#define MSGMAX 8192 /* <= INT_MAX */ /* max size of message (bytes) */
|
|
#define MSGMNB 16384 /* <= INT_MAX */ /* default max size of a message queue */
|
|
|
|
/* unused */
|
|
#define MSGPOOL (MSGMNI * MSGMNB / 1024) /* size in kbytes of message pool */
|
|
#define MSGTQL MSGMNB /* number of system message headers */
|
|
#define MSGMAP MSGMNB /* number of entries in message map */
|
|
#define MSGSSZ 16 /* message segment size */
|
|
#define __MSGSEG ((MSGPOOL * 1024) / MSGSSZ) /* max no. of segments */
|
|
#define MSGSEG (__MSGSEG <= 0xffff ? __MSGSEG : 0xffff)
|
|
|
|
#ifdef __KERNEL__
|
|
#include <linux/list.h>
|
|
|
|
/* one msg_msg structure for each message */
|
|
struct msg_msg {
|
|
struct list_head m_list;
|
|
long m_type;
|
|
size_t m_ts; /* message text size */
|
|
struct msg_msgseg* next;
|
|
void *security;
|
|
/* the actual message follows immediately */
|
|
};
|
|
|
|
/* one msq_queue structure for each present queue on the system */
|
|
struct msg_queue {
|
|
struct kern_ipc_perm q_perm;
|
|
time_t q_stime; /* last msgsnd time */
|
|
time_t q_rtime; /* last msgrcv time */
|
|
time_t q_ctime; /* last change time */
|
|
unsigned long q_cbytes; /* current number of bytes on queue */
|
|
unsigned long q_qnum; /* number of messages in queue */
|
|
unsigned long q_qbytes; /* max number of bytes on queue */
|
|
pid_t q_lspid; /* pid of last msgsnd */
|
|
pid_t q_lrpid; /* last receive pid */
|
|
|
|
struct list_head q_messages;
|
|
struct list_head q_receivers;
|
|
struct list_head q_senders;
|
|
};
|
|
|
|
/* Helper routines for sys_msgsnd and sys_msgrcv */
|
|
extern long do_msgsnd(int msqid, long mtype, void __user *mtext,
|
|
size_t msgsz, int msgflg);
|
|
extern long do_msgrcv(int msqid, long *pmtype, void __user *mtext,
|
|
size_t msgsz, long msgtyp, int msgflg);
|
|
|
|
#endif /* __KERNEL__ */
|
|
|
|
#endif /* _LINUX_MSG_H */
|