From patchwork Mon Mar 15 13:55:17 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 400458 Delivered-To: patch@linaro.org Received: by 2002:a02:8562:0:0:0:0:0 with SMTP id g89csp3461227jai; Mon, 15 Mar 2021 07:15:46 -0700 (PDT) X-Google-Smtp-Source: ABdhPJxIibVv6tHFquuIun+sQILOxgMrnP1CUXUQ8DYddrFqqxShGorE7CUmVOfbhwyr1+dgJhIY X-Received: by 2002:a17:906:b159:: with SMTP id bt25mr23630537ejb.364.1615817746490; Mon, 15 Mar 2021 07:15:46 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1615817746; cv=none; d=google.com; s=arc-20160816; b=TsKwtqV37xa9keAHAi6vlT4dmpkDZi/RErCmhxAld2xG0KlG45VjLeGc3/fe9rLxZi 0F3AVaMYkvmoFQPbNs3uLOEdEWZw0FxmJj4yBZBnEcOLlqsXW4X7gUxUTg/J+xrJRIK7 9Cap/sj4nqAvhZySKYL7yJz6CJWafIDcJ0uosffVtBVel65tRvLbKmbaDOd9gEEUAzzD nEiRAbpCbPDd6L67qpK26SCxSaLmPMvOQWjMJH1MMV0yOU+HwbNAFMfDSISo1Vi/6log 3jneUHc3j9EKFcFj1bUrfYSNebgFBoKpEuZR2wgFVq4Bb5ovnp/KPAxBN0CCYGZRKxb/ Erdw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=596ZkdI+z25ZCJRDDhhZUEUt28J0A49DnxADS4OyxoU=; b=FrgxtqBlS7q6RCLe37erqYTsjzct1USK/Hq/LaG4aNMjp1V1ZkPrZrwwXuWQeNpb5m D1FUs83FIo/JRBueYMeCsMSeQvFCcyOfdqbiDe21GGGkEuLIDUgU0/oALlPMQ2vqI5F0 h/YpmFss1lgkPqsTExkdBDUWDMhofoE8H3c/Wxo2vxM6mcf4rwRYJ4LApgaIGYw/DWn/ kp3mPD/6sPZIQ41FhkQUUCVNi5bn7GKqsAU9xYzEAFUKBXQIoGUiQhILXWy/nlyGg3Qw tZSEHVmDHhvdA9KDNoahOcXltQ2GwOiD1cem81mEckDDnYovGO5h3mkFhEY/0jhHoktB toGw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=RnmDYhIJ; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id h21si993553ede.37.2021.03.15.07.15.46; Mon, 15 Mar 2021 07:15:46 -0700 (PDT) Received-SPF: pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=RnmDYhIJ; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235297AbhCOOIm (ORCPT + 12 others); Mon, 15 Mar 2021 10:08:42 -0400 Received: from mail.kernel.org ([198.145.29.99]:49418 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234128AbhCOOC6 (ORCPT ); Mon, 15 Mar 2021 10:02:58 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 0974F64EEE; Mon, 15 Mar 2021 14:02:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1615816978; bh=pahPprvgMlC98Q1N7i19LIWDb7xGXm3jUnB5rspMKQg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=RnmDYhIJYCKZL/jNUY1WM55Ai+mulZLZLmMSP3dBBWspKILzGtQLwxHr6taV6h3b+ HJJKi4AdFMgTEjGXaYlqeKO8VVf2wrjcGaSILVReTAfWDVc1pbxnuPdFkvZSKiBVyy AYNjHAtq4TAkseynAUerv0ZdnKCwoSP9NnlXNMvk= From: gregkh@linuxfoundation.org To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Srinivas Kandagatla , Jonathan Marek , Dmitry Baryshkov Subject: [PATCH 5.10 224/290] misc: fastrpc: restrict user apps from sending kernel RPC messages Date: Mon, 15 Mar 2021 14:55:17 +0100 Message-Id: <20210315135549.545419195@linuxfoundation.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20210315135541.921894249@linuxfoundation.org> References: <20210315135541.921894249@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Greg Kroah-Hartman From: Dmitry Baryshkov commit 20c40794eb85ea29852d7bc37c55713802a543d6 upstream. Verify that user applications are not using the kernel RPC message handle to restrict them from directly attaching to guest OS on the remote subsystem. This is a port of CVE-2019-2308 fix. Fixes: c68cfb718c8f ("misc: fastrpc: Add support for context Invoke method") Cc: Srinivas Kandagatla Cc: Jonathan Marek Cc: stable@vger.kernel.org Signed-off-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20210212192658.3476137-1-dmitry.baryshkov@linaro.org Signed-off-by: Greg Kroah-Hartman --- drivers/misc/fastrpc.c | 5 +++++ 1 file changed, 5 insertions(+) --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -948,6 +948,11 @@ static int fastrpc_internal_invoke(struc if (!fl->cctx->rpdev) return -EPIPE; + if (handle == FASTRPC_INIT_HANDLE && !kernel) { + dev_warn_ratelimited(fl->sctx->dev, "user app trying to send a kernel RPC message (%d)\n", handle); + return -EPERM; + } + ctx = fastrpc_context_alloc(fl, kernel, sc, args); if (IS_ERR(ctx)) return PTR_ERR(ctx);