kernel/sysctl_binary.c: check name array length in deprecated_sysctl_warning()
Prevent use of uninitialized memory (originating from the stack frame of do_sysctl()) by verifying that the name array is filled with sufficient input data before comparing its specific entries with integer constants. Through timing measurement or analyzing the kernel debug logs, a user-mode program could potentially infer the results of comparisons against the uninitialized memory, and acquire some (very limited) information about the state of the kernel stack. The change also eliminates possible future warnings by tools such as KMSAN and other code checkers / instrumentations. Change-Id: I44af72c8ffe080593a0f2cd88b3a1c93fb661e07 Link: http://lkml.kernel.org/r/20170524122139.21333-1-mjurczyk@google.com Signed-off-by: Mateusz Jurczyk <mjurczyk@google.com> Acked-by: Kees Cook <keescook@chromium.org> Cc: "David S. Miller" <davem@davemloft.net> Cc: Matthew Whitehead <tedheadster@gmail.com> Cc: "Eric W. Biederman" <ebiederm@xmission.com> Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Cc: Alexander Potapenko <glider@google.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
This commit is contained in:
parent
95c69db736
commit
830bd1187c
|
@ -1383,7 +1383,7 @@ static void deprecated_sysctl_warning(const int *name, int nlen)
|
|||
* CTL_KERN/KERN_VERSION is used by older glibc and cannot
|
||||
* ever go away.
|
||||
*/
|
||||
if (name[0] == CTL_KERN && name[1] == KERN_VERSION)
|
||||
if (nlen >= 2 && name[0] == CTL_KERN && name[1] == KERN_VERSION)
|
||||
return;
|
||||
|
||||
if (printk_ratelimit()) {
|
||||
|
|
Loading…
Reference in New Issue