From patchwork Mon Mar 15 13:55:58 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 400449 Delivered-To: patch@linaro.org Received: by 2002:a02:8562:0:0:0:0:0 with SMTP id g89csp3453866jai; Mon, 15 Mar 2021 07:09:14 -0700 (PDT) X-Google-Smtp-Source: ABdhPJwiR7Ko1+KuIaMqIldn7WeruVqr5bommDhIvmTaTeCQfj6DFHv5y6RNMXDAwhFZJ9GKPiy3 X-Received: by 2002:a17:906:3b48:: with SMTP id h8mr23682668ejf.261.1615817354636; Mon, 15 Mar 2021 07:09:14 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1615817354; cv=none; d=google.com; s=arc-20160816; b=y1iOUfwz36FoFxxuLPed7sV/aLvGfMGZ3GO3MROmSJ06zLKnTzXQ/3lYYkMwdNx+73 018JqQRXGY3htdiUETcMAcnZeEmabuk2qs8jc7ebs4rVBkRuQ9qC1WYaW405q9Tut272 +nhPoM4wNU0r7A5g5LYDTR5yLiuFpYXM5+5TAbgGsIQ6t3X3yGtpt5drWpuIQYTRwwxE M8ShLuw6zyeRPpsIVYiExK6aJnGJHSuMHUPWAKkpMLKmDLq+VYxid8KMEvQ37Mwd+X9n fNI2Xu9PII/z8EGiH/KWt5GB8fJS6wDtSMbrEU2C8HHkDMRoDAmF+7d51Cab5hVejzAi Mvlw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=42nN4Np2W2vVoiQJk6nUdTI+V/S0euBInGffhVas0QA=; b=sfQi0YAh/lQlEhT1Td4q8ioOvjum8M4CII7+wPo2QCkE3TNUW8aWFo06kN6w0FKa+6 rnterOiaFeiJxe2QFkgB9kRVzgfNm5czVhR1WgGzdEZ+3pKwxIr7jzTjy6oLw7i1ZFXe XLOddPTVl+sIHsljDlpN80VofZd5oiLq0yD4jZGHVWr2gYI743a/Ei3XC05fMso1TArn bK/0//545vYaUBrEasg7eZxkFQ2kJTsjzxMnSrgLDatoDL0fOoCgs6NaAuSap86Ln8T1 n1qbhBFGQxjoytBOab9bJyej9G4lRLGqO4V1ItR1ShRZ+zwE7pnGX+XkNI4kn0XEXpnE MTlQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=EFTb1LaG; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id h21si993553ede.37.2021.03.15.07.09.14; Mon, 15 Mar 2021 07:09:14 -0700 (PDT) Received-SPF: pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=EFTb1LaG; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231712AbhCOOD6 (ORCPT + 12 others); Mon, 15 Mar 2021 10:03:58 -0400 Received: from mail.kernel.org ([198.145.29.99]:36788 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233020AbhCOOAe (ORCPT ); Mon, 15 Mar 2021 10:00:34 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 9F09464F2B; Mon, 15 Mar 2021 14:00:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1615816812; bh=Ka8gW4bNWcdAax6/0NiwlubvqKWPXd3fZbvk1dYbZoc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=EFTb1LaGYgBGb2grvX4+vMYede4z/fDE0qFqEaHNtZhEucvbIvZ4O+Aj9R+A407V9 zxXxprK4jbGeSk27blAUkAPg6N+8KIOrKRJLkZOCs64KbNnw5ATFe71yR4PqH6eJc4 L3VjRZZ4/2wvWbZqo77aIQe0N0MhIc/YT8WQw3/k= From: gregkh@linuxfoundation.org To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Srinivas Kandagatla , Jonathan Marek , Dmitry Baryshkov Subject: [PATCH 5.4 126/168] misc: fastrpc: restrict user apps from sending kernel RPC messages Date: Mon, 15 Mar 2021 14:55:58 +0100 Message-Id: <20210315135554.491454698@linuxfoundation.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20210315135550.333963635@linuxfoundation.org> References: <20210315135550.333963635@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Greg Kroah-Hartman From: Dmitry Baryshkov commit 20c40794eb85ea29852d7bc37c55713802a543d6 upstream. Verify that user applications are not using the kernel RPC message handle to restrict them from directly attaching to guest OS on the remote subsystem. This is a port of CVE-2019-2308 fix. Fixes: c68cfb718c8f ("misc: fastrpc: Add support for context Invoke method") Cc: Srinivas Kandagatla Cc: Jonathan Marek Cc: stable@vger.kernel.org Signed-off-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20210212192658.3476137-1-dmitry.baryshkov@linaro.org Signed-off-by: Greg Kroah-Hartman --- drivers/misc/fastrpc.c | 5 +++++ 1 file changed, 5 insertions(+) --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -924,6 +924,11 @@ static int fastrpc_internal_invoke(struc if (!fl->cctx->rpdev) return -EPIPE; + if (handle == FASTRPC_INIT_HANDLE && !kernel) { + dev_warn_ratelimited(fl->sctx->dev, "user app trying to send a kernel RPC message (%d)\n", handle); + return -EPERM; + } + ctx = fastrpc_context_alloc(fl, kernel, sc, args); if (IS_ERR(ctx)) return PTR_ERR(ctx);