summaryrefslogtreecommitdiff
path: root/kernel
diff options
context:
space:
mode:
authorTycho Andersen <tycho@tycho.ws>2018-02-21 05:47:46 +0300
committerKees Cook <keescook@chromium.org>2018-02-22 03:56:03 +0300
commit63bb0045b98ae821e56e27c2250e14bb0ae663e5 (patch)
treed26e642414ee3be9dbeb4d963b77a557eb62238b /kernel
parent2a040f9f39d3b020c79e08dec26d12a7ce131c10 (diff)
downloadlinux-63bb0045b98ae821e56e27c2250e14bb0ae663e5.tar.xz
ptrace, seccomp: tweak get_metadata behavior slightly
Previously if users passed a small size for the input structure size, they would get get odd behavior. It doesn't make sense to pass a structure smaller than at least filter_off size, so let's just give -EINVAL in this case. This changes userspace visible behavior, but was only introduced in commit 26500475ac1b ("ptrace, seccomp: add support for retrieving seccomp metadata") in 4.16-rc2, so should be safe to change if merged before then. Reported-by: Eugene Syromiatnikov <esyr@redhat.com> Signed-off-by: Tycho Andersen <tycho@tycho.ws> CC: Kees Cook <keescook@chromium.org> CC: Oleg Nesterov <oleg@redhat.com> Signed-off-by: Kees Cook <keescook@chromium.org>
Diffstat (limited to 'kernel')
-rw-r--r--kernel/seccomp.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index 61bd9dc260c8..1245b2338fff 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -1076,14 +1076,16 @@ long seccomp_get_metadata(struct task_struct *task,
size = min_t(unsigned long, size, sizeof(kmd));
- if (copy_from_user(&kmd, data, size))
+ if (size < sizeof(kmd.filter_off))
+ return -EINVAL;
+
+ if (copy_from_user(&kmd.filter_off, data, sizeof(kmd.filter_off)))
return -EFAULT;
filter = get_nth_filter(task, kmd.filter_off);
if (IS_ERR(filter))
return PTR_ERR(filter);
- memset(&kmd, 0, sizeof(kmd));
if (filter->log)
kmd.flags |= SECCOMP_FILTER_FLAG_LOG;