dm ioctl: prevent stack leak in dm ioctl call
authorAdrian Salido <salidoa@google.com>
Thu, 27 Apr 2017 17:32:55 +0000 (10:32 -0700)
committerBen Hutchings <ben@decadent.org.uk>
Sat, 26 Aug 2017 01:14:40 +0000 (02:14 +0100)
commitaebe2f15c355c9e209f6583b69b0bda269d57f3f
treebba10a8991194314c2ba9b59e0a0720ba6689f1f
parent356fab890aa4b8f093861d6217914b24b033b2aa
dm ioctl: prevent stack leak in dm ioctl call

commit 4617f564c06117c7d1b611be49521a4430042287 upstream.

When calling a dm ioctl that doesn't process any data
(IOCTL_FLAGS_NO_PARAMS), the contents of the data field in struct
dm_ioctl are left initialized.  Current code is incorrectly extending
the size of data copied back to user, causing the contents of kernel
stack to be leaked to user.  Fix by only copying contents before data
and allow the functions processing the ioctl to override.

Signed-off-by: Adrian Salido <salidoa@google.com>
Reviewed-by: Alasdair G Kergon <agk@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
drivers/md/dm-ioctl.c