• Thadeu Lima de Souza Cascardo's avatar
    fs/binfmt_misc.c: do not allow offset overflow · 250edf95
    Thadeu Lima de Souza Cascardo authored
    commit 5cc41e09 upstream.
    WHen registering a new binfmt_misc handler, it is possible to overflow
    the offset to get a negative value, which might crash the system, or
    possibly leak kernel data.
    Here is a crash log when 2500000000 was used as an offset:
      BUG: unable to handle kernel paging request at ffff989cfd6edca0
      IP: load_misc_binary+0x22b/0x470 [binfmt_misc]
      PGD 1ef3e067 P4D 1ef3e067 PUD 0
      Oops: 0000 [#1] SMP NOPTI
      Modules linked in: binfmt_misc kvm_intel ppdev kvm irqbypass joydev input_leds serio_raw mac_hid parport_pc qemu_fw_cfg parpy
      CPU: 0 PID: 2499 Comm: bash Not tainted 4.15.0-22-generic #24-Ubuntu
      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.1-1 04/01/2014
      RIP: 0010:load_misc_binary+0x22b/0x470 [binfmt_misc]
      Call Trace:
    Use kstrtoint instead of simple_strtoul.  It will work as the code
    already set the delimiter byte to '\0' and we only do it when the field
    is not empty.
    Tested with offsets -1, 2500000000, UINT_MAX and INT_MAX.  Also tested
    with examples documented at Documentation/admin-guide/binfmt-misc.rst
    and other registrations from packages on Ubuntu.
    Link: http://lkml.kernel.org/r/20180529135648.14254-1-cascardo@canonical.com
    Fixes: 1da177e4 ("Linux-2.6.12-rc2")
    Signed-off-by: default avatarThadeu Lima de Souza Cascardo <cascardo@canonical.com>
    Reviewed-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Cc: Alexander Viro <viro@zeniv.linux.org.uk>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>