Skip to content
Commit 9de30f3f authored by Tycho Andersen's avatar Tycho Andersen Committed by David Teigland
Browse files

dlm: don't leak kernel pointer to userspace

In copy_result_to_user(), we first create a struct dlm_lock_result, which
contains a struct dlm_lksb, the last member of which is a pointer to the
lvb. Unfortunately, we copy the entire struct dlm_lksb to the result
struct, which is then copied to userspace at the end of the function,
leaking the contents of sb_lvbptr, which is a valid kernel pointer in some
cases (indeed, later in the same function the data it points to is copied
to userspace).

It is an error to leak kernel pointers to userspace, as it undermines KASLR
protections (see e.g. 65eea8ed

 ("floppy: Do not copy a kernel pointer to
user memory in FDGETPRM ioctl") for another example of this).

Signed-off-by: default avatarTycho Andersen <tycho@tycho.ws>
Signed-off-by: default avatarDavid Teigland <teigland@redhat.com>
parent 3f0806d2
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment