isdn: Disable IIOCDBGVAR

BugLink: https://bugs.launchpad.net/bugs/1835845
[ Upstream commit 5e22002aa8809e2efab2da95855f73f63e14a36c ]

It was possible to directly leak the kernel address where the isdn_dev
structure pointer was stored. This is a kernel ASLR bypass for anyone
with access to the ioctl. The code had been present since the beginning
of git history, though this shouldn't ever be needed for normal operation,
therefore remove it.

Reported-by: Al Viro <viro@zeniv.linux.org.uk>
Cc: Karsten Keil <isdn@linux-pingi.de>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>

diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c
index 8b03d618185e3c7c0c74c7dc8bad6fe1169f7e19..5f1119ca9a398bbbb33b2c603ea6211143946ef2 100644 (file)
--- a/drivers/isdn/i4l/isdn_common.c
+++ b/drivers/isdn/i4l/isdn_common.c
@@ -1640,13 +1640,7 @@ isdn_ioctl(struct file *file, uint cmd, ulong arg)
                        } else
                                return -EINVAL;
                case IIOCDBGVAR:
-                       if (arg) {
-                               if (copy_to_user(argp, &dev, sizeof(ulong)))
-                                       return -EFAULT;
-                               return 0;
-                       } else
-                               return -EINVAL;
-                       break;
+                       return -EINVAL;
                default:
                        if ((cmd & IIOCDRVCTL) == IIOCDRVCTL)
                                cmd = ((cmd >> _IOC_NRSHIFT) & _IOC_NRMASK) & ISDN_DRVIOCTL_MASK;