From patchwork Mon Mar 15 13:54:43 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 400463 Delivered-To: patch@linaro.org Received: by 2002:a02:8562:0:0:0:0:0 with SMTP id g89csp3462189jai; Mon, 15 Mar 2021 07:16:40 -0700 (PDT) X-Google-Smtp-Source: ABdhPJzEi25DHkc8YX0IcNUIgXbpisUDk7NG7F3HWCOl9kXcZyf3gli7eJLJSmcWzM02RBrn9AUT X-Received: by 2002:a50:ec0e:: with SMTP id g14mr30477405edr.264.1615817724645; Mon, 15 Mar 2021 07:15:24 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1615817724; cv=none; d=google.com; s=arc-20160816; b=BBcvxPb+Ak2OBnHHwMfF9QfCdOawIIh1kpBMDcXBku6PqytG82yeMeuxE81Am8YTvP DSoAAwFOOL5L8qtY4K6t8KWVFjqGMrdVandW2cHpbb7O1XEwClK7NP02VkcDnOfOZ8uL MOYPiEFXaQVWibWKMXfH3ajNSqlWj4uxcxzBpfOaa6l2l6S2bjcbrAvobBa34ZDp5a2z eyPc23XgkQVuuBLATrhoEfeVAakq3pSUNJM9t+Jg23CrwVYF/FtzJ3mXl2la6NHhzG1i 85qG9fAiNR/9ZCxIdifll8AQ9BuOqFbwp6czn4VS8j1xsRBsFsbPPMCG9ez3ct1+7zwt a/tg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=90x5dKs94Mf89b4ZaAlxYdEJZ07YUWUhXQw9mIJl9DY=; b=jdcmrxyjOcFtU/dHVPw17LRBg7sWl0FAw/OB+EIApxlb+H/7bXkBJx7iSAKIZneBah 4UCWj+AscL4pLNUeo4VrY1TupTU13zCLjsndzEVC3a0ahh1Q/QbCCKYHuv3/DYhtaLrs 4MN5O5HjKGzFx6eq5X0mKR7YE8/mIsKqTp3Jc7oWIGJcxlgag4HfWdSVKKUd3Fzg6ucM JvFjQOdPumO2X/f2M+6G2VTKARWLZeMUcwFH+vIee9+CBy4p8xyUkjrHeryF9/TgGnXq zg99jS4Lc3rgvmbSp0+HR4J0kgoN5JYj8o/c0Fi+G3yzWoMYLAqZSTUunlCy770a+6BT UOYg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=bQKZzfA1; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id h21si993553ede.37.2021.03.15.07.15.24; Mon, 15 Mar 2021 07:15:24 -0700 (PDT) Received-SPF: pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=bQKZzfA1; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232653AbhCOOIE (ORCPT + 12 others); Mon, 15 Mar 2021 10:08:04 -0400 Received: from mail.kernel.org ([198.145.29.99]:49074 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233792AbhCOOC1 (ORCPT ); Mon, 15 Mar 2021 10:02:27 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 1503864EEE; Mon, 15 Mar 2021 14:02:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1615816947; bh=RN75x/A94mjN2UFU9gW7nIGSelmOyH6pWJnZ512dQT4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=bQKZzfA15wpbevjt0yleIgfKeaKb1RUy0cPtvhuYAIM0+rZW7hvH1wSNs1tgjmp2w Ht8aY3DpXYyFm/AX7Dwr9Dsp6cfRVzG3tyTLkrO5f8CwiRe5DEU533YylVwWfDfutC gbWUFFpzB/Q/LxdHMV7oFuh6Tk9mTlUTnavs1/fs= From: gregkh@linuxfoundation.org To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Srinivas Kandagatla , Jonathan Marek , Dmitry Baryshkov Subject: [PATCH 5.11 220/306] misc: fastrpc: restrict user apps from sending kernel RPC messages Date: Mon, 15 Mar 2021 14:54:43 +0100 Message-Id: <20210315135515.054318944@linuxfoundation.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20210315135507.611436477@linuxfoundation.org> References: <20210315135507.611436477@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Greg Kroah-Hartman From: Dmitry Baryshkov commit 20c40794eb85ea29852d7bc37c55713802a543d6 upstream. Verify that user applications are not using the kernel RPC message handle to restrict them from directly attaching to guest OS on the remote subsystem. This is a port of CVE-2019-2308 fix. Fixes: c68cfb718c8f ("misc: fastrpc: Add support for context Invoke method") Cc: Srinivas Kandagatla Cc: Jonathan Marek Cc: stable@vger.kernel.org Signed-off-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20210212192658.3476137-1-dmitry.baryshkov@linaro.org Signed-off-by: Greg Kroah-Hartman --- drivers/misc/fastrpc.c | 5 +++++ 1 file changed, 5 insertions(+) --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -950,6 +950,11 @@ static int fastrpc_internal_invoke(struc if (!fl->cctx->rpdev) return -EPIPE; + if (handle == FASTRPC_INIT_HANDLE && !kernel) { + dev_warn_ratelimited(fl->sctx->dev, "user app trying to send a kernel RPC message (%d)\n", handle); + return -EPERM; + } + ctx = fastrpc_context_alloc(fl, kernel, sc, args); if (IS_ERR(ctx)) return PTR_ERR(ctx);