Wenwen Wang bd23a72698 virt: vbox: Only copy_from_user the request-header once ... In vbg_misc_device_ioctl(), the header of the ioctl argument is copied from the userspace pointer 'arg' and saved to the kernel object 'hdr'. Then the 'version', 'size_in', and 'size_out' fields of 'hdr' are verified. Before this commit, after the checks a buffer for the entire request would be allocated and then all data including the verified header would be copied from the userspace 'arg' pointer again. Given that the 'arg' pointer resides in userspace, a malicious userspace process can race to change the data pointed to by 'arg' between the two copies. By doing so, the user can bypass the verifications on the ioctl argument. This commit fixes this by using the already checked copy of the header to fill the header part of the allocated buffer and only copying the remainder of the data from userspace. Signed-off-by: Wenwen Wang <wang6495@umn.edu> Reviewed-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2018-05-14 16:31:59 +02:00
..
Kconfig	virt: Add vboxguest driver for Virtual Box Guest integration	2017-12-18 16:12:22 +01:00
Makefile	virt: Add vboxguest driver for Virtual Box Guest integration	2017-12-18 16:12:22 +01:00
vboxguest_core.c	virt: vbox: Log an error when we fail to get the host version	2018-04-23 13:41:55 +02:00
vboxguest_core.h	virt: vbox: Add vbg_req_free() helper function	2018-04-23 13:41:55 +02:00
vboxguest_linux.c	virt: vbox: Only copy_from_user the request-header once	2018-05-14 16:31:59 +02:00
vboxguest_utils.c	virt: vbox: Use __get_free_pages instead of kmalloc for DMA32 memory	2018-04-23 13:41:55 +02:00
vboxguest_version.h	virt: Add vboxguest driver for Virtual Box Guest integration	2017-12-18 16:12:22 +01:00
vmmdev.h