isdn: Disable IIOCDBGVAR
It was possible to directly leak the kernel address where the isdn_dev structure pointer was stored. This is a kernel ASLR bypass for anyone with access to the ioctl. The code had been present since the beginning of git history, though this shouldn't ever be needed for normal operation, therefore remove it. Reported-by: Al Viro <viro@zeniv.linux.org.uk> Cc: Karsten Keil <isdn@linux-pingi.de> Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
4531681837
commit
5e22002aa8
|
@ -1640,13 +1640,7 @@ isdn_ioctl(struct file *file, uint cmd, ulong arg)
|
||||||
} else
|
} else
|
||||||
return -EINVAL;
|
return -EINVAL;
|
||||||
case IIOCDBGVAR:
|
case IIOCDBGVAR:
|
||||||
if (arg) {
|
return -EINVAL;
|
||||||
if (copy_to_user(argp, &dev, sizeof(ulong)))
|
|
||||||
return -EFAULT;
|
|
||||||
return 0;
|
|
||||||
} else
|
|
||||||
return -EINVAL;
|
|
||||||
break;
|
|
||||||
default:
|
default:
|
||||||
if ((cmd & IIOCDRVCTL) == IIOCDRVCTL)
|
if ((cmd & IIOCDRVCTL) == IIOCDRVCTL)
|
||||||
cmd = ((cmd >> _IOC_NRSHIFT) & _IOC_NRMASK) & ISDN_DRVIOCTL_MASK;
|
cmd = ((cmd >> _IOC_NRSHIFT) & _IOC_NRMASK) & ISDN_DRVIOCTL_MASK;
|
||||||
|
|
Loading…
Reference in New Issue