isdn: Disable IIOCDBGVAR
authorKees Cook <keescook@chromium.org>
Wed, 15 Aug 2018 19:14:05 +0000 (12:14 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 22 Aug 2018 05:46:11 +0000 (07:46 +0200)
commit2b2cdec98e035b57b0374418fd5e3ba1610c9f10
tree3dc0001b6dec2c83872acdf6d4e261bc409e1e76
parentf276e2efb66118e3fd98e38a7903b204c85e4cec
isdn: Disable IIOCDBGVAR

[ Upstream commit 5e22002aa8809e2efab2da95855f73f63e14a36c ]

It was possible to directly leak the kernel address where the isdn_dev
structure pointer was stored. This is a kernel ASLR bypass for anyone
with access to the ioctl. The code had been present since the beginning
of git history, though this shouldn't ever be needed for normal operation,
therefore remove it.

Reported-by: Al Viro <viro@zeniv.linux.org.uk>
Cc: Karsten Keil <isdn@linux-pingi.de>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/isdn/i4l/isdn_common.c