[patch 71/71] S390: CVE-2008-1514: prevent ptrace padding area read/write in 31-bit mode

!MAILaRCHIVE_VOTE_RePLACE
Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]
To: <linux-kernel@...>, <stable@...>
Cc: Justin Forbes <jmforbes@...>, Zwane Mwaikambo <zwane@...>, Theodore Ts'o <tytso@...>, Randy Dunlap <rdunlap@...>, Dave Jones <davej@...>, Chuck Wolber <chuckw@...>, Chris Wedgwood <reviews@...>, Michael Krufky <mkrufky@...>, Chuck Ebbert <cebbert@...>, Domenico Andreoli <cavokz@...>, Willy Tarreau <w@...>, Rodrigo Rubira Branco <rbranco@...>, Jake Edge <jake@...>, Eugene Teo <eteo@...>, <torvalds@...>, <akpm@...>, <alan@...>, Jarod Wilson <jarod@...>, Martin Schwidefsky <schwidefsky@...>, Moritz Muehlenhoff <jmm@...>
Date: Monday, October 6, 2008 - 8:40 pm

2.6.26-stable review patch.  If anyone has any objections, please let us
know.

------------------
From: Jarod Wilson <jwilson@redhat.com>

commit 3d6e48f43340343d97839eadb1ab7b6a3ea98797 upstream

When running a 31-bit ptrace, on either an s390 or s390x kernel,
reads and writes into a padding area in struct user_regs_struct32
will result in a kernel panic.

This is also known as CVE-2008-1514.

Test case available here:
http://sources.redhat.com/cgi-bin/cvsweb.cgi/~checkout~/tests/ptrace-tests/tests/user-...

Steps to reproduce:
1) wget the above
2) gcc -o user-area-padding-31bit user-area-padding.c -Wall -ggdb2 -D_GNU_SOURCE -m31
3) ./user-area-padding-31bit
<panic>

Test status
-----------
Without patch, both s390 and s390x kernels panic. With patch, the test case,
as well as the gdb testsuite, pass without incident, padding area reads
returning zero, writes ignored.

Nb: original version returned -EINVAL on write attempts, which broke the
gdb test and made the test case slightly unhappy, Jan Kratochvil suggested
the change to return 0 on write attempts.

Signed-off-by: Jarod Wilson <jarod@redhat.com>
Tested-by: Jan Kratochvil <jan.kratochvil@redhat.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc: Moritz Muehlenhoff <jmm@debian.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 arch/s390/kernel/compat_ptrace.h |    1 +
 arch/s390/kernel/ptrace.c        |   28 ++++++++++++++++++++++++++++
 2 files changed, 29 insertions(+)

--- a/arch/s390/kernel/compat_ptrace.h
+++ b/arch/s390/kernel/compat_ptrace.h
@@ -42,6 +42,7 @@ struct user_regs_struct32
 	u32 gprs[NUM_GPRS];
 	u32 acrs[NUM_ACRS];
 	u32 orig_gpr2;
+	/* nb: there's a 4-byte hole here */
 	s390_fp_regs fp_regs;
 	/*
 	 * These per registers are in here so that gdb can modify them
--- a/arch/s390/kernel/ptrace.c
+++ b/arch/s390/kernel/ptrace.c
@@ -177,6 +177,13 @@ peek_user(struct task_struct *child, add
 		 */
 		tmp = (addr_t) task_pt_regs(child)->orig_gpr2;
 
+	} else if (addr < (addr_t) &dummy->regs.fp_regs) {
+		/*
+		 * prevent reads of padding hole between
+		 * orig_gpr2 and fp_regs on s390.
+		 */
+		tmp = 0;
+
 	} else if (addr < (addr_t) (&dummy->regs.fp_regs + 1)) {
 		/* 
 		 * floating point regs. are stored in the thread structure
@@ -268,6 +275,13 @@ poke_user(struct task_struct *child, add
 		 */
 		task_pt_regs(child)->orig_gpr2 = data;
 
+	} else if (addr < (addr_t) &dummy->regs.fp_regs) {
+		/*
+		 * prevent writes of padding hole between
+		 * orig_gpr2 and fp_regs on s390.
+		 */
+		return 0;
+
 	} else if (addr < (addr_t) (&dummy->regs.fp_regs + 1)) {
 		/*
 		 * floating point regs. are stored in the thread structure
@@ -409,6 +423,13 @@ peek_user_emu31(struct task_struct *chil
 		 */
 		tmp = *(__u32*)((addr_t) &task_pt_regs(child)->orig_gpr2 + 4);
 
+	} else if (addr < (addr_t) &dummy32->regs.fp_regs) {
+		/*
+		 * prevent reads of padding hole between
+		 * orig_gpr2 and fp_regs on s390.
+		 */
+		tmp = 0;
+
 	} else if (addr < (addr_t) (&dummy32->regs.fp_regs + 1)) {
 		/*
 		 * floating point regs. are stored in the thread structure 
@@ -488,6 +509,13 @@ poke_user_emu31(struct task_struct *chil
 		 */
 		*(__u32*)((addr_t) &task_pt_regs(child)->orig_gpr2 + 4) = tmp;
 
+	} else if (addr < (addr_t) &dummy32->regs.fp_regs) {
+		/*
+		 * prevent writess of padding hole between
+		 * orig_gpr2 and fp_regs on s390.
+		 */
+		return 0;
+
 	} else if (addr < (addr_t) (&dummy32->regs.fp_regs + 1)) {
 		/*
 		 * floating point regs. are stored in the thread structure 

-- 
--
Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]

Messages in current thread:
[patch 00/71] 2.6.26-stable review, Greg KH, (Mon Oct 6, 8:36 pm)
Re: [patch 00/71] 2.6.26-stable review, Grant Coady, (Tue Oct 7, 12:42 am)
Re: [patch 00/71] 2.6.26-stable review, Greg KH, (Tue Oct 7, 12:59 am)
[patch 71/71] S390: CVE-2008-1514: prevent ptrace padding ar..., Greg KH, (Mon Oct 6, 8:40 pm)
[patch 59/71] udp: Fix rcv socket locking, Greg KH, (Mon Oct 6, 8:40 pm)
[patch 54/71] niu: panic on reset, Greg KH, (Mon Oct 6, 8:39 pm)
[patch 34/71] rtc: fix deadlock, Greg KH, (Mon Oct 6, 8:38 pm)
[patch 33/71] mm: dirty page tracking race fix, Greg KH, (Mon Oct 6, 8:38 pm)
[patch 29/71] x86: fdiv bug detection fix, Greg KH, (Mon Oct 6, 8:38 pm)
[patch 24/71] APIC routing fix, Greg KH, (Mon Oct 6, 8:38 pm)
[patch 11/71] USB: fix hcd interrupt disabling, Greg KH, (Mon Oct 6, 8:37 pm)
[patch 09/71] pxa2xx_spi: chipselect bugfixes, Greg KH, (Mon Oct 6, 8:37 pm)
[patch 08/71] pxa2xx_spi: dma bugfixes, Greg KH, (Mon Oct 6, 8:37 pm)
[patch 02/71] ACPI: Fix thermal shutdowns, Greg KH, (Mon Oct 6, 8:37 pm)