mirror of
https://github.com/brain-hackers/linux-brain.git
synced 2024-06-09 07:16:21 +09:00
isdn: Disable IIOCDBGVAR
[ Upstream commit 5e22002aa8
]
It was possible to directly leak the kernel address where the isdn_dev
structure pointer was stored. This is a kernel ASLR bypass for anyone
with access to the ioctl. The code had been present since the beginning
of git history, though this shouldn't ever be needed for normal operation,
therefore remove it.
Reported-by: Al Viro <viro@zeniv.linux.org.uk>
Cc: Karsten Keil <isdn@linux-pingi.de>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
cdd187871c
commit
4daf820df7
|
@ -1655,13 +1655,7 @@ isdn_ioctl(struct file *file, uint cmd, ulong arg)
|
|||
} else
|
||||
return -EINVAL;
|
||||
case IIOCDBGVAR:
|
||||
if (arg) {
|
||||
if (copy_to_user(argp, &dev, sizeof(ulong)))
|
||||
return -EFAULT;
|
||||
return 0;
|
||||
} else
|
||||
return -EINVAL;
|
||||
break;
|
||||
return -EINVAL;
|
||||
default:
|
||||
if ((cmd & IIOCDRVCTL) == IIOCDRVCTL)
|
||||
cmd = ((cmd >> _IOC_NRSHIFT) & _IOC_NRMASK) & ISDN_DRVIOCTL_MASK;
|
||||
|
|
Loading…
Reference in New Issue
Block a user