Commit 2882d53c authored by Sargun Dhillon's avatar Sargun Dhillon Committed by Kees Cook

seccomp: Check that seccomp_notif is zeroed out by the user

This patch is a small change in enforcement of the uapi for
SECCOMP_IOCTL_NOTIF_RECV ioctl. Specifically, the datastructure which
is passed (seccomp_notif) must be zeroed out. Previously any of its
members could be set to nonsense values, and we would ignore it.

This ensures all fields are set to their zero value.
Signed-off-by: default avatarSargun Dhillon <sargun@sargun.me>
Reviewed-by: default avatarChristian Brauner <christian.brauner@ubuntu.com>
Reviewed-by: default avatarAleksa Sarai <cyphar@cyphar.com>
Acked-by: default avatarTycho Andersen <tycho@tycho.ws>
Link: https://lore.kernel.org/r/20191229062451.9467-2-sargun@sargun.me
Fixes: 6a21cc50 ("seccomp: add a return code to trap to userspace")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
parent 88c13f8b
...@@ -1026,6 +1026,13 @@ static long seccomp_notify_recv(struct seccomp_filter *filter, ...@@ -1026,6 +1026,13 @@ static long seccomp_notify_recv(struct seccomp_filter *filter,
struct seccomp_notif unotif; struct seccomp_notif unotif;
ssize_t ret; ssize_t ret;
/* Verify that we're not given garbage to keep struct extensible. */
ret = check_zeroed_user(buf, sizeof(unotif));
if (ret < 0)
return ret;
if (!ret)
return -EINVAL;
memset(&unotif, 0, sizeof(unotif)); memset(&unotif, 0, sizeof(unotif));
ret = down_interruptible(&filter->notif->request); ret = down_interruptible(&filter->notif->request);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment