[linux] 02/03: Don't feed anything but regular iovec's to blk_rq_map_user_iov (CVE-2016-9576)

[debian-kernel at lists.debian.org]

This is an automated email from the git hooks/post-receive script.

carnil pushed a commit to branch sid
in repository linux.

commit d2f4158d99e00ca2587f365776e4afd1eeb7740c
Author: Salvatore Bonaccorso <carnil at debian.org>
Date:   Sat Dec 10 07:34:44 2016 +0100

    Don't feed anything but regular iovec's to blk_rq_map_user_iov (CVE-2016-9576)
---
 debian/changelog                                   |  1 +
 ...anything-but-regular-iovec-s-to-blk_rq_ma.patch | 41 ++++++++++++++++++++++
 debian/patches/series                              |  1 +
 3 files changed, 43 insertions(+)

diff --git a/debian/changelog b/debian/changelog
index 1011d70..2a72204 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -50,6 +50,7 @@ linux (4.8.12-1) UNRELEASED; urgency=medium
   * Add ABI reference for 4.8.0-2
   * Ignore ABI changes in KVM
   * net: ping: check minimum size on ICMP header length (CVE-2016-8399)
+  * Don't feed anything but regular iovec's to blk_rq_map_user_iov (CVE-2016-9576)
 
   [ Ben Hutchings ]
   * [amd64] Re-enable LEGACY_VSYSCALL_EMULATE instead of LEGACY_VSYSCALL_NONE.
diff --git a/debian/patches/bugfix/all/Don-t-feed-anything-but-regular-iovec-s-to-blk_rq_ma.patch b/debian/patches/bugfix/all/Don-t-feed-anything-but-regular-iovec-s-to-blk_rq_ma.patch
new file mode 100644
index 0000000..d2525ca
--- /dev/null
+++ b/debian/patches/bugfix/all/Don-t-feed-anything-but-regular-iovec-s-to-blk_rq_ma.patch
@@ -0,0 +1,41 @@
+From: Linus Torvalds <torvalds at linux-foundation.org>
+Date: Tue, 6 Dec 2016 16:18:14 -0800
+Subject: Don't feed anything but regular iovec's to blk_rq_map_user_iov
+Origin: https://git.kernel.org/linus/a0ac402cfcdc904f9772e1762b3fda112dcc56a0
+
+In theory we could map other things, but there's a reason that function
+is called "user_iov".  Using anything else (like splice can do) just
+confuses it.
+
+Reported-and-tested-by: Johannes Thumshirn <jthumshirn at suse.de>
+Cc: Al Viro <viro at ZenIV.linux.org.uk>
+Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
+---
+ block/blk-map.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/block/blk-map.c b/block/blk-map.c
+index b8657fa..27fd8d92 100644
+--- a/block/blk-map.c
++++ b/block/blk-map.c
+@@ -118,6 +118,9 @@ int blk_rq_map_user_iov(struct request_queue *q, struct request *rq,
+ 	struct iov_iter i;
+ 	int ret;
+ 
++	if (!iter_is_iovec(iter))
++		goto fail;
++
+ 	if (map_data)
+ 		copy = true;
+ 	else if (iov_iter_alignment(iter) & align)
+@@ -140,6 +143,7 @@ int blk_rq_map_user_iov(struct request_queue *q, struct request *rq,
+ 
+ unmap_rq:
+ 	__blk_rq_unmap_user(bio);
++fail:
+ 	rq->bio = NULL;
+ 	return -EINVAL;
+ }
+-- 
+2.1.4
+
diff --git a/debian/patches/series b/debian/patches/series
index 840611b..6ba9df0 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -106,6 +106,7 @@ bugfix/all/tipc-check-minimum-bearer-MTU.patch
 bugfix/all/packet-fix-race-condition-in-packet_set_ring.patch
 bugfix/all/net-avoid-signed-overflows-for-SO_-SND-RCV-BUFFORCE.patch
 bugfix/all/net-ping-check-minimum-size-on-ICMP-header-length.patch
+bugfix/all/Don-t-feed-anything-but-regular-iovec-s-to-blk_rq_ma.patch
 
 # ABI maintenance
 

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/kernel/linux.git