Bug 116751 - Double-Fetch bug in Linux-4.5/drivers/scsi/aacraid/commctrl.c
Summary: Double-Fetch bug in Linux-4.5/drivers/scsi/aacraid/commctrl.c
Status: NEW
Alias: None
Product: SCSI Drivers
Classification: Unclassified
Component: AACRAID (show other bugs)
Hardware: All Linux
: P1 high
Assignee: scsi_drivers-aacraid
Depends on:
Reported: 2016-04-19 21:45 UTC by Pengfei Wang
Modified: 2016-04-25 16:23 UTC (History)
1 user (show)

See Also:
Kernel Version: 4.5
Regression: No
Bisected commit-id:

source file (23.74 KB, application/octet-stream)
2016-04-25 16:23 UTC, Pengfei Wang

Description Pengfei Wang 2016-04-19 21:45:45 UTC

I found this Double-Fetch bug in Linux-4.5/drivers/scsi/aacraid/commctrl.c when I was examining the source code. 

In function ioctl_send_fib(), the driver fetches user space data by pointer arg via copy_from_user(), and this happens twice at line 81 and line 116 respectively. The first fetched value (stored in kfib) is used to get the header and calculate the size at line 90 so as to copy the whole message later at line 116, which means the copy size of the whole message is based on the old value that came from the first fetch. Besides, the whole message copied in the  second fetch also contains the header.

However, when the function processes the message after the second fetch at line 130, it uses kfib->header.Size that came from the second fetch, which might be different from the one came from the first fetch as well as calculated the size to copy the message from user space to driver. 

If the kfib->header.Size is modified by a user thread under race condition between the fetch operations, for example changing to a very large value, this will lead to over-boundary access or other serious consequences in function aac_fib_send().

I am looking forward to a reply on this, thank you!

Kind regards
Comment 1 Pengfei Wang 2016-04-25 16:23:01 UTC
Created attachment 214111 [details]
source file

Note You need to log in before you can comment on or make changes to this bug.