I've submitted 8 such bugs several weeks before and thanks to Chris and
other guys to fix most of them. Here are another 30 similar bugs. I got a
warning in net/ipv4, which must be that I'm missing something, so please
clarify. Also it seems I'm missing some assumptions for those video
drivers.
As usual, any responses will be appreciated. Thanks!
Where bugs occur:
net/ipv4/ip_sockglue.c
drivers/i2c/i2c-dev.c
drivers/ieee1394/video1394.c
drivers/isdn/eicon/linchr.c
drivers/media/dvb/av7110/av7110_ir.c
drivers/media/radio/radio-cadet.c
drivers/media/video/bw-qcam.c
drivers/media/video/cpia.c
drivers/media/video/zoran_procfs.c
drivers/media/video/zr36120.c
drivers/pnp/pnpbios/proc.c
drivers/scsi/aacraid/commctrl.c
drivers/usb/image/mdc800.c
drivers/usb/media/vicam.c
drivers/usb/serial/empeg.c
drivers/usb/serial/io_edgeport.c
drivers/usb/serial/ipaq.c
drivers/usb/serial/keyspan.c
drivers/video/sis/sis_main.c
sound/oss/awe_wave.c
sound/oss/cmpci.c
sound/oss/mpu401.c
sound/pci/es1938.c
[UNKNOWN] maybe? it is in ipv4 though. ip_cmsg_send -> ip_options_get
implies CMSG_DATA(cmsg) is tainted. It could be that the taintedness of CMSG_DATA(cmsg) depends on the case branch
/home/junfeng/linux-tainted/net/ipv4/ip_sockglue.c:168:ip_cmsg_send: ERROR:TAINTED:168:168: dereferencing tainted ptr 'info' [Callstack: /home/junfeng/linux-tainted/net/ipv4/ip_options.c:518:ip_cmsg_send()]
{
struct in_pktinfo *info;
if (cmsg->cmsg_len != CMSG_LEN(sizeof(struct in_pktinfo)))
return -EINVAL;
info = (struct in_pktinfo *)CMSG_DATA(cmsg);
Error --->
ipc->oif = info->ipi_ifindex;
ipc->addr = info->ipi_spec_dst.s_addr;
break;
}
---------------------------------------------------------
[BUG] buf is tainted. can print out arbitrary kernel data
/home/junfeng/linux-tainted/drivers/usb/serial/empeg.c:225:empeg_write: ERROR:TAINTED:225:225: passing tainted ptr 'buf' to usb_serial_debug_data [Callstack: /home/junfeng/linux-tainted/drivers/usb/serial/safe_serial.c:327:empeg_write((tainted 2))]
int bytes_sent = 0;
int transfer_size;
dbg("%s - port %d", __FUNCTION__, port->number);
Error --->
usb_serial_debug_data (__FILE__, __FUNCTION__, count, buf);
while (count > 0) {
---------------------------------------------------------
[BUG] can print out arbitrary kernel data
/home/junfeng/linux-tainted/drivers/usb/serial/ipaq.c:371:ipaq_write: ERROR:TAINTED:371:371: passing tainted ptr 'buf' to usb_serial_debug_data [Callstack: /home/junfeng/linux-tainted/drivers/usb/serial/safe_serial.c:327:ipaq_write((tainted 2))]
int bytes_sent = 0;
int transfer_size;
dbg("%s - port %d", __FUNCTION__, port->number);
Error --->
usb_serial_debug_data(__FILE__, __FUNCTION__, count, buf);
while (count > 0) {
transfer_size = min(count, PACKET_SIZE);
---------------------------------------------------------
[BUG] can print out arbitrary kernel data
/home/junfeng/linux-tainted/drivers/usb/serial/keyspan.c:328:keyspan_write: ERROR:TAINTED:328:328: dereferencing tainted ptr 'buf' [Callstack: ]
p_priv = usb_get_serial_port_data(port);
d_details = p_priv->device_details;
dbg("%s - for port %d (%d chars [%x]), flip=%d",
Error --->
__FUNCTION__, port->number, count, buf[0], p_priv->out_flip);
for (left = count; left > 0; left -= todo) {
todo = left;
---------------------------------------------------------
[BUG] pointer (rdwr_arg.msgs[i]) points to user space
/home/junfeng/linux-tainted/drivers/i2c/i2c-dev.c:230:i2cdev_ioctl: ERROR:TAINTED:230:230: dereferencing tainted ptr 'rdwr_arg.msgs + i * 12' [Callstack: ]
if(rdwr_pa[i].buf == NULL)
{
res = -ENOMEM;
break;
}
Error --->
if(copy_from_user(rdwr_pa[i].buf,
rdwr_arg.msgs[i].buf,
rdwr_pa[i].len))
{
---------------------------------------------------------
[BUG] file_operations.read. even the parm itself has a name pUserBuffer
/home/junfeng/linux-tainted/drivers/isdn/eicon/linchr.c:166:do_read: ERROR:TAINTED:166:166: passing tainted ptr 'pClientLogBuffer' to __constant_memcpy [Callstack: /home/junfeng/linux-tainted/drivers/scsi/sg.c:362:do_read((tainted 1))]
pHeadItem = (klog_t *) DivasLogFifoRead();
if (pHeadItem)
{
Error --->
memcpy(pClientLogBuffer, pHeadItem, sizeof(klog_t));
kfree(pHeadItem);
return sizeof(klog_t);
}
---------------------------------------------------------
[BUG] file_operations.write -> cm_write -> trans_ac3. write can take tainted. write can take tainted inputs.
/home/junfeng/linux-tainted/sound/oss/cmpci.c:593:trans_ac3: ERROR:TAINTED:593:593: dereferencing tainted ptr 'src' [Callstack: /home/junfeng/linux-tainted/fs/read_write.c:307:vfs_write((tainted 1)(tainted 2)) -> /home/junfeng/linux-tainted/fs/read_write.c:241:cm_write((tainted 1)(tainted 2)) -> /home/junfeng/linux-tainted/sound/oss/cmpci.c:1662:trans_ac3((tainted 2))]
unsigned long data;
unsigned long *dst = (unsigned long *) dest;
unsigned short *src = (unsigned short *)source;
do {
Error --->
data = (unsigned long) *src++;
data <<= 12; // ok for 16-bit data
if (s->spdif_counter == 2 || s->spdif_counter == 3)
data |= 0x40000000; // indicate AC-3 raw data
---------------------------------------------------------
[BUG] in ioctl function. v (==arg) is not checked at all. can write arbitrary data to the kernel. on the same case branch, copy_to_user is called on arg
/home/junfeng/linux-tainted/drivers/media/radio/radio-cadet.c:397:cadet_do_ioctl: ERROR:TAINTED:397:397: dereferencing tainted ptr 'v' [Callstack: ]
{
case VIDIOCGCAP:
{
struct video_capability *v = arg;
memset(v,0,sizeof(*v));
Error --->
v->type=VID_TYPE_TUNER;
v->channels=2;
v->audios=1;
strcpy(v->name, "ADS Cadet");
---------------------------------------------------------
[BUG] no check in sis_main.c at all. can write arbitrary data to kernel
/home/junfeng/linux-tainted/drivers/video/sis/sis_main.c:2476:sisfb_ioctl: ERROR:TAINTED:2476:2476: dereferencing tainted ptr 'x' [Callstack: /home/junfeng/linux-tainted/drivers/video/sstfb.c:808:sisfb_ioctl((tainted 3))]
}
case FBIOPUT_MODEINFO:
{
struct mode_info *x = (struct mode_info *)arg;
Error --->
ivideo.video_bpp = x->bpp;
ivideo.video_width = x->xres;
ivideo.video_height = x->yres;
ivideo.video_vwidth = x->v_xres;
---------------------------------------------------------
[BUG] on VIDIOCGCAPUTRE and VIDIOCSCAPUTRE branches copy_*_user functions are called. on other branches not
/home/junfeng/linux-tainted/drivers/media/video/cpia.c:3432:cpia_do_ioctl: ERROR:TAINTED:3432:3432: dereferencing tainted ptr 'vp' [Callstack: ]
DBG("VIDIOCSPICT\n");
/* check validity */
DBG("palette: %d\n", vp->palette);
DBG("depth: %d\n", vp->depth);
Error --->
if (!valid_mode(vp->palette, vp->depth)) {
retval = -EINVAL;
break;
}
---------------------------------------------------------
[BUG] sisfb_ioctl->sis_dispinfo. drivers/video/sstfb_ioctl assumes "arg" is tainted. both of them are assigned to fb_ops.fb_ioctl
/home/junfeng/linux-tainted/drivers/video/sis/sis_main.c:276:sis_dispinfo: ERROR:TAINTED:276:276: dereferencing tainted ptr 'rec' [Callstack: /home/junfeng/linux-tainted/drivers/video/sstfb.c:808:sisfb_ioctl((tainted 3)) -> /home/junfeng/linux-tainted/drivers/video/sis/sis_main.c:2488:sis_dispinfo((tainted 0))]
gly->ngmask = size;
}
void sis_dispinfo(struct ap_data *rec)
{
Error --->
rec->minfo.bpp = ivideo.video_bpp;
rec->minfo.xres = ivideo.video_width;
rec->minfo.yres = ivideo.video_height;
rec->minfo.v_xres = ivideo.video_vwidth;
---------------------------------------------------------
[BUG] mdc800_device_read is assigned to file_operations.read, which can take tainted inputs
/home/junfeng/linux-tainted/drivers/usb/image/mdc800.c:750:mdc800_device_read: ERROR:TAINTED:750:750: passing tainted ptr 'ptr' to __memcpy [Callstack: /home/junfeng/linux-tainted/drivers/scsi/sg.c:362:mdc800_device_read((tainted 1))]
}
}
else
{
/* memcpy Bytes */
Error --->
memcpy (ptr, &mdc800->out [mdc800->out_ptr], sts);
ptr+=sts;
left-=sts;
mdc800->out_ptr+=sts;
---------------------------------------------------------
[BUG] call usb_serial_debug_data on data
/home/junfeng/linux-tainted/drivers/usb/serial/io_edgeport.c:1381:edge_write: ERROR:TAINTED:1381:1381: passing tainted ptr 'data' to usb_serial_debug_data [Callstack: ]
fifo->head += secondhalf;
// No need to check for wrap since we can not get to end of fifo in this part
}
if (copySize) {
Error --->
usb_serial_debug_data (__FILE__, __FUNCTION__, copySize, data);
}
send_more_port_data((struct edgeport_serial *)usb_get_serial_data(port->serial), edge_port);
---------------------------------------------------------
[BUG] proc_dir_entry.read_proc can take tainted inputs
/home/junfeng/linux-tainted/drivers/usb/media/vicam.c:1117:vicam_write_proc_gain: ERROR:TAINTED:1117:1117: passing tainted ptr 'buffer' to simple_strtoul [Callstack: /home/junfeng/linux-tainted/net/core/pktgen.c:991:vicam_write_proc_gain((tainted 1))]
static int vicam_write_proc_gain(struct file *file, const char *buffer,
unsigned long count, void *data)
{
struct vicam_camera *cam = (struct vicam_camera *)data;
Error --->
cam->gain = simple_strtoul(buffer, NULL, 10);
return count;
}
---------------------------------------------------------
[BUG] midi_synth.c:midi_synth_ioctl does __copy_to_user(not copy_to_user?). it could be that there are some assumptions about the devices.
/home/junfeng/linux-tainted/sound/oss/mpu401.c:792:mpu_synth_ioctl: ERROR:TAINTED:792:792: passing tainted ptr 'arg' to __constant_memcpy [Callstack: /home/junfeng/linux-tainted/sound/oss/midi_synth.c:270:mpu_synth_ioctl((tainted 2))]
switch (cmd)
{
case SNDCTL_SYNTH_INFO:
Error --->
memcpy((&((char *) arg)[0]), (char *) &mpu_synth_info[midi_dev], sizeof(struct synth_info));
return 0;
case SNDCTL_SYNTH_MEMAVL:
---------------------------------------------------------
[BUG] similar errors
/home/junfeng/linux-tainted/drivers/media/radio/radio-cadet.c:399:cadet_do_ioctl: ERROR:TAINTED:399:399: dereferencing tainted ptr 'v' [Callstack: ]
{
struct video_capability *v = arg;
memset(v,0,sizeof(*v));
v->type=VID_TYPE_TUNER;
v->channels=2;
Error --->
v->audios=1;
strcpy(v->name, "ADS Cadet");
return 0;
}
---------------------------------------------------------
[BUG] ioctl
/home/junfeng/linux-tainted/drivers/usb/media/vicam.c:617:vicam_ioctl: ERROR:TAINTED:617:617: dereferencing tainted ptr 'vp' [Callstack: /home/junfeng/linux-tainted/drivers/scsi/sg.c:1002:vicam_ioctl((tainted 3))]
struct video_picture *vp = (struct video_picture *) arg;
DBG("VIDIOCSPICT depth = %d, pal = %d\n", vp->depth,
vp->palette);
Error --->
cam->gain = vp->brightness >> 8;
if (vp->depth != 24
|| vp->palette != VIDEO_PALETTE_RGB24)
---------------------------------------------------------
[BUG] copy_to_user is called on case VIDIOCGCHAN
/home/junfeng/linux-tainted/drivers/media/video/bw-qcam.c:763:qcam_do_ioctl: ERROR:TAINTED:763:763: dereferencing tainted ptr 'p' [Callstack: ]
return 0;
}
case VIDIOCGPICT:
{
struct video_picture *p = arg;
Error --->
p->colour=0x8000;
p->hue=0x8000;
p->brightness=qcam->brightness<<8;
p->contrast=qcam->contrast<<8;
---------------------------------------------------------
[BUG]
/home/junfeng/linux-tainted/drivers/media/video/bw-qcam.c:723:qcam_do_ioctl: ERROR:TAINTED:723:723: dereferencing tainted ptr 'v' [Callstack: ]
case VIDIOCGCHAN:
{
struct video_channel *v = arg;
if(v->channel!=0)
return -EINVAL;
Error --->
v->flags=0;
v->tuners=0;
/* Good question.. its composite or SVHS so.. */
v->type = VIDEO_TYPE_CAMERA;
---------------------------------------------------------
[BUG] file_opetations.ioctl -> aac_cfg_ioctl -> aac_do_ioctl -> close_getadapter_fib -> aac_close_fib_context. also, check_revision calls copy_to_user on "arg"
/home/junfeng/linux-tainted/drivers/scsi/aacraid/commctrl.c:277:aac_close_fib_context: ERROR:TAINTED:277:277: dereferencing tainted ptr 'fibctx' [Callstack: /home/junfeng/linux-tainted/drivers/scsi/sg.c:1002:aac_cfg_ioctl((tainted 3)) -> /home/junfeng/linux-tainted/drivers/scsi/aacraid/linit.c:671:aac_do_ioctl((tainted 2)) -> /home/junfeng/linux-tainted/drivers/scsi/aacraid/commctrl.c:421:close_getadapter_fib((tainted 1)) -> /home/junfeng/linux-tainted/drivers/scsi/aacraid/commctrl.c:348:aac_close_fib_context((tainted 1))]
while (!list_empty(&fibctx->fibs)) {
struct list_head * entry;
/*
* Pull the next fib from the fibs
*/
Error --->
entry = fibctx->fibs.next;
list_del(entry);
fib = list_entry(entry, struct hw_fib, header.FibLinks);
fibctx->count--;
---------------------------------------------------------
[BUG] zoran_read and vbi_read are both assigned to video_device.read, while zoran_read assumes "buf" is tainted
/home/junfeng/linux-tainted/drivers/media/video/zr36120.c:1698:vbi_read: ERROR:TAINTED:1698:1698: dereferencing tainted ptr 'optr' [Callstack: /home/junfeng/linux-tainted/drivers/media/video/zr36120.c:934:vbi_read((tainted 1))]
{
/* copy to doubled data to userland */
for (x=0; optr+1<eptr && x<-done->w; x++)
{
unsigned char a = iptr[x*2];
Error --->
*optr++ = a;
*optr++ = a;
}
/* and clear the rest of the line */
---------------------------------------------------------
[BUG] video1394_ioctl's param arg is tainted -> initialize_dma_it_prg_var_packet_queue's param packet_sizes is also tainted
/home/junfeng/linux-tainted/drivers/ieee1394/video1394.c:668:initialize_dma_it_prg_var_packet_queue: ERROR:TAINTED:668:668: dereferencing tainted ptr 'packet_sizes + i * 4' [Callstack: /home/junfeng/linux-tainted/drivers/ieee1394/video1394.c:1047:initialize_dma_it_prg_var_packet_queue((tainted 2))]
for (i = 0; i < d->nb_cmd; i++) {
unsigned int size;
if (packet_sizes[i] > d->packet_size) {
size = d->packet_size;
} else {
Error --->
size = packet_sizes[i];
}
it_prg[i].data[1] = cpu_to_le32(size << 16);
it_prg[i].end.control = cpu_to_le32(DMA_CTL_OUTPUT_LAST | DMA_CTL_BRANCH);
---------------------------------------------------------
[BUG] sound/pci/rme9652/rme9652.c:snd_rme9652_capture_copy treats the parm "dst" as tainted and they are both assigned to snd_pcm_ops_t.copy
/home/junfeng/linux-tainted/sound/pci/es1938.c:833:snd_es1938_capture_copy: ERROR:TAINTED:833:833: passing tainted ptr 'dst' to __constant_memcpy [Callstack: /home/junfeng/linux-tainted/sound/pci/rme9652/rme9652.c:2010:snd_es1938_capture_copy((tainted 3))]
es1938_t *chip = snd_pcm_substream_chip(substream);
pos <<= chip->dma1_shift;
count <<= chip->dma1_shift;
snd_assert(pos + count <= chip->dma1_size, return -EINVAL);
if (pos + count < chip->dma1_size)
Error --->
memcpy(dst, runtime->dma_area + pos + 1, count);
else {
memcpy(dst, runtime->dma_area + pos + 1, count - 1);
((unsigned char *)dst)[count - 1] = runtime->dma_area[0];
---------------------------------------------------------
[BUG] proc_dir_entry.write_proc
/home/junfeng/linux-tainted/drivers/media/video/zoran_procfs.c:122:zoran_write_proc: ERROR:TAINTED:122:122: passing tainted ptr 'buffer' to __memcpy [Callstack: /home/junfeng/linux-tainted/net/core/pktgen.c:991:zoran_write_proc((tainted 1))]
string = sp = vmalloc(count + 1);
if (!string) {
printk(KERN_ERR "%s: write_proc: can not allocate memory\n", zr->name);
return -ENOMEM;
}
Error --->
memcpy(string, buffer, count);
string[count] = 0;
DEBUG2(printk(KERN_INFO "%s: write_proc: name=%s count=%lu data=%x\n", zr->name, file->f_dentry->d_name.name, count, (int) data));
ldelim = " \t\n";
---------------------------------------------------------
[BUG] proc_dir_entry.write_proc
/home/junfeng/linux-tainted/drivers/pnp/pnpbios/proc.c:190:proc_write_node: ERROR:TAINTED:190:190: passing tainted ptr 'buf' to __memcpy [Callstack: /home/junfeng/linux-tainted/net/core/pktgen.c:991:proc_write_node((tainted 1))]
if (!node) return -ENOMEM;
if ( pnp_bios_get_dev_node(&nodenum, boot, node) )
return -EIO;
if (count != node->size - sizeof(struct pnp_bios_node))
return -EINVAL;
Error --->
memcpy(node->data, buf, count);
if (pnp_bios_set_dev_node(node->handle, boot, node) != 0)
return -EINVAL;
kfree(node);
---------------------------------------------------------
[BUG] file_operations.write
/home/junfeng/linux-tainted/drivers/usb/image/mdc800.c:805:mdc800_device_write: ERROR:TAINTED:805:805: dereferencing tainted ptr 'buf + i' [Callstack: /home/junfeng/linux-tainted/drivers/media/dvb/av7110/av7110.c:3858:mdc800_device_write((tainted 1))]
}
/* save command byte */
if (mdc800->in_count < 8)
{
Error --->
mdc800->in[mdc800->in_count]=buf[i];
mdc800->in_count++;
}
else
---------------------------------------------------------
[BUG] proc_dir_entry.write_proc can take tainted inputs
/home/junfeng/linux-tainted/drivers/usb/media/vicam.c:1107:vicam_write_proc_shutter: ERROR:TAINTED:1107:1107: passing tainted ptr 'buffer' to simple_strtoul [Callstack: /home/junfeng/linux-tainted/net/core/pktgen.c:991:vicam_write_proc_shutter((tainted 1))]
static int vicam_write_proc_shutter(struct file *file, const char *buffer,
unsigned long count, void *data)
{
struct vicam_camera *cam = (struct vicam_camera *)data;
Error --->
cam->shutter_speed = simple_strtoul(buffer, NULL, 10);
return count;
}
---------------------------------------------------------
[BUG] av7110_ir_write_proc is assigned to proc_dir_entry.write_proc
/home/junfeng/linux-tainted/drivers/media/dvb/av7110/av7110_ir.c:116:av7110_ir_write_proc: ERROR:TAINTED:116:116: passing tainted ptr 'buffer' to __constant_memcpy [Callstack: /home/junfeng/linux-tainted/net/core/pktgen.c:991:av7110_ir_write_proc((tainted 1))]
u32 ir_config;
if (count < 4 + 256 * sizeof(u16))
return -EINVAL;
Error --->
memcpy (&ir_config, buffer, 4);
memcpy (&key_map, buffer + 4, 256 * sizeof(u16));
av7110_setup_irc_config (NULL, ir_config);
---------------------------------------------------------
[BUG] pointer (rdwr_arg.msgs[i]) points to user space
/home/junfeng/linux-tainted/drivers/i2c/i2c-dev.c:249:i2cdev_ioctl: ERROR:TAINTED:249:249: dereferencing tainted ptr 'rdwr_arg.msgs + i * 12' [Callstack: ]
}
while(i-- > 0)
{
if( res>=0 && (rdwr_pa[i].flags & I2C_M_RD))
{
Error --->
if(copy_to_user(
rdwr_arg.msgs[i].buf,
rdwr_pa[i].buf,
rdwr_pa[i].len))
---------------------------------------------------------
[BUG] ioctl
/home/junfeng/linux-tainted/sound/oss/awe_wave.c:2049:awe_ioctl: ERROR:TAINTED:2049:2049: passing tainted ptr 'arg' to __constant_memcpy [Callstack: /home/junfeng/linux-tainted/sound/oss/midi_synth.c:270:awe_ioctl((tainted 2))]
case SNDCTL_SYNTH_INFO:
if (playing_mode == AWE_PLAY_DIRECT)
awe_info.nr_voices = awe_max_voices;
else
awe_info.nr_voices = AWE_MAX_CHANNELS;
Error --->
memcpy((char*)arg, &awe_info, sizeof(awe_info));
return 0;
break;
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/