Revision 3958b79266b14729edd61daf9dfb84de45f4ec6d authored by Nicolas Iooss on 17 July 2015, 23:23:45 UTC, committed by Linus Torvalds on 17 July 2015, 23:39:53 UTC
Some modules call config_item_init_type_name() and config_group_init_type_name()
with parameter "name" directly controlled by userspace.  These two
functions call config_item_set_name() with this name used as a format
string, which can be used to leak information such as content of the
stack to userspace.

For example, make_netconsole_target() in netconsole module calls
config_item_init_type_name() with the name of a newly-created directory.
This means that the following commands give some unexpected output, with
configfs mounted in /sys/kernel/config/ and on a system with a
configured eth0 ethernet interface:

    # modprobe netconsole
    # mkdir /sys/kernel/config/netconsole/target_%lx
    # echo eth0 > /sys/kernel/config/netconsole/target_%lx/dev_name
    # echo 1 > /sys/kernel/config/netconsole/target_%lx/enabled
    # echo eth0 > /sys/kernel/config/netconsole/target_%lx/dev_name
    # dmesg |tail -n1
    [  142.697668] netconsole: target (target_ffffffffc0ae8080) is
    enabled, disable to update parameters

The directory name is correct but %lx has been interpreted in the
internal item name, displayed here in the error message used by
store_dev_name() in drivers/net/netconsole.c.

To fix this, update every caller of config_item_set_name to use "%s"
when operating on untrusted input.

This issue was found using -Wformat-security gcc flag, once a __printf
attribute has been added to config_item_set_name().

Signed-off-by: Nicolas Iooss <nicolas.iooss_linux@m4x.org>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Felipe Balbi <balbi@ti.com>
Acked-by: Joel Becker <jlbec@evilplan.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent 8db1486
Raw File
Makefile
# Some of the tools (perf) use same make variables
# as in kernel build.
export srctree=
export objtree=

include scripts/Makefile.include

help:
	@echo 'Possible targets:'
	@echo ''
	@echo '  acpi       - ACPI tools'
	@echo '  cgroup     - cgroup tools'
	@echo '  cpupower   - a tool for all things x86 CPU power'
	@echo '  firewire   - the userspace part of nosy, an IEEE-1394 traffic sniffer'
	@echo '  hv         - tools used when in Hyper-V clients'
	@echo '  iio        - IIO tools'
	@echo '  lguest     - a minimal 32-bit x86 hypervisor'
	@echo '  perf       - Linux performance measurement and analysis tool'
	@echo '  selftests  - various kernel selftests'
	@echo '  turbostat  - Intel CPU idle stats and freq reporting tool'
	@echo '  usb        - USB testing tools'
	@echo '  virtio     - vhost test module'
	@echo '  net        - misc networking tools'
	@echo '  vm         - misc vm tools'
	@echo '  x86_energy_perf_policy - Intel energy policy tool'
	@echo '  tmon       - thermal monitoring and tuning tool'
	@echo '  freefall   - laptop accelerometer program for disk protection'
	@echo ''
	@echo 'You can do:'
	@echo ' $$ make -C tools/ <tool>_install'
	@echo ''
	@echo '  from the kernel command line to build and install one of'
	@echo '  the tools above'
	@echo ''
	@echo '  $$ make tools/install'
	@echo ''
	@echo '  installs all tools.'
	@echo ''
	@echo 'Cleaning targets:'
	@echo ''
	@echo '  all of the above with the "_clean" string appended cleans'
	@echo '    the respective build directory.'
	@echo '  clean: a summary clean target to clean _all_ folders'

acpi: FORCE
	$(call descend,power/$@)

cpupower: FORCE
	$(call descend,power/$@)

cgroup firewire hv guest usb virtio vm net iio: FORCE
	$(call descend,$@)

liblockdep: FORCE
	$(call descend,lib/lockdep)

libapi: FORCE
	$(call descend,lib/api)

# The perf build does not follow the descend function setup,
# invoking it via it's own make rule.
PERF_O   = $(if $(O),$(O)/tools/perf,)

perf: FORCE
	$(Q)mkdir -p $(PERF_O) .
	$(Q)$(MAKE) --no-print-directory -C perf O=$(PERF_O) subdir=

selftests: FORCE
	$(call descend,testing/$@)

turbostat x86_energy_perf_policy: FORCE
	$(call descend,power/x86/$@)

tmon: FORCE
	$(call descend,thermal/$@)

freefall: FORCE
	$(call descend,laptop/$@)

acpi_install:
	$(call descend,power/$(@:_install=),install)

cpupower_install:
	$(call descend,power/$(@:_install=),install)

cgroup_install firewire_install hv_install lguest_install perf_install usb_install virtio_install vm_install net_install:
	$(call descend,$(@:_install=),install)

selftests_install:
	$(call descend,testing/$(@:_clean=),install)

turbostat_install x86_energy_perf_policy_install:
	$(call descend,power/x86/$(@:_install=),install)

tmon_install:
	$(call descend,thermal/$(@:_install=),install)

freefall_install:
	$(call descend,laptop/$(@:_install=),install)

install: acpi_install cgroup_install cpupower_install hv_install firewire_install lguest_install \
		perf_install selftests_install turbostat_install usb_install \
		virtio_install vm_install net_install x86_energy_perf_policy_install \
		tmon freefall_install

acpi_clean:
	$(call descend,power/acpi,clean)

cpupower_clean:
	$(call descend,power/cpupower,clean)

cgroup_clean hv_clean firewire_clean lguest_clean usb_clean virtio_clean vm_clean net_clean iio_clean:
	$(call descend,$(@:_clean=),clean)

liblockdep_clean:
	$(call descend,lib/lockdep,clean)

libapi_clean:
	$(call descend,lib/api,clean)

perf_clean:
	$(call descend,$(@:_clean=),clean)

selftests_clean:
	$(call descend,testing/$(@:_clean=),clean)

turbostat_clean x86_energy_perf_policy_clean:
	$(call descend,power/x86/$(@:_clean=),clean)

tmon_clean:
	$(call descend,thermal/tmon,clean)

freefall_clean:
	$(call descend,laptop/freefall,clean)

clean: acpi_clean cgroup_clean cpupower_clean hv_clean firewire_clean lguest_clean \
		perf_clean selftests_clean turbostat_clean usb_clean virtio_clean \
		vm_clean net_clean iio_clean x86_energy_perf_policy_clean tmon_clean \
		freefall_clean

.PHONY: FORCE
back to top