Re: [PATCH] floppy: Do not copy a kernel pointer to user memory in FDGETPRM ioctl

[Brian Belleville]

Hi, are there any comments on this patch or the issue I described? I 
have tested the FDGETPRM ioctl and confirmed that the struct it returns 
does contain a pointer to kernel data. I also have tested my patch, and 
with it applied the returned struct no longer contains a kernel pointer, 
but all other fields are still present.

Thank you,
Brian Belleville


On 03/07/2018 04:02 PM, Brian Belleville wrote:
> The final field of a floppy_struct is the field "name", which is a
> pointer to a string in kernel memory. The kernel pointer should not be
> copied to user memory. The FDGETPRM ioctl copies a floppy_struct to
> user memory, including the "name" field. This pointer cannot be used
> by the user, and it will leak a kernel address to user-space, which
> will reveal the location of kernel code and data and undermine KASLR
> protection. Instead, copy the floppy_struct except for the "name"
> field.
>
> Signed-off-by: Brian Belleville <bbellevi@xxxxxxx>
> ---
>   drivers/block/floppy.c | 1 +
>   1 file changed, 1 insertion(+)
>
> diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
> index eae484a..4d4a422 100644
> --- a/drivers/block/floppy.c
> +++ b/drivers/block/floppy.c
> @@ -3470,6 +3470,7 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
>   					  (struct floppy_struct **)&outparam);
>   		if (ret)
>   			return ret;
> +		size = offsetof(struct floppy_struct, name);
>   		break;
>   	case FDMSGON:
>   		UDP->flags |= FTD_MSG;