• Tycho Andersen's avatar
    dlm: don't leak kernel pointer to userspace · 9de30f3f
    Tycho Andersen authored
    In copy_result_to_user(), we first create a struct dlm_lock_result, which
    contains a struct dlm_lksb, the last member of which is a pointer to the
    lvb. Unfortunately, we copy the entire struct dlm_lksb to the result
    struct, which is then copied to userspace at the end of the function,
    leaking the contents of sb_lvbptr, which is a valid kernel pointer in some
    cases (indeed, later in the same function the data it points to is copied
    to userspace).
    
    It is an error to leak kernel pointers to userspace, as it undermines KASLR
    protections (see e.g. 65eea8ed ("floppy: Do not copy a kernel pointer to
    user memory in FDGETPRM ioctl") for another example of this).
    Signed-off-by: default avatarTycho Andersen <tycho@tycho.ws>
    Signed-off-by: default avatarDavid Teigland <teigland@redhat.com>
    9de30f3f
user.c 24.6 KB