isdn: Disable IIOCDBGVAR

It was possible to directly leak the kernel address where the isdn_dev
structure pointer was stored. This is a kernel ASLR bypass for anyone
with access to the ioctl. The code had been present since the beginning
of git history, though this shouldn't ever be needed for normal operation,
therefore remove it.

Reported-by: Al Viro <[email protected]>
Cc: Karsten Keil <[email protected]>
Signed-off-by: Kees Cook <[email protected]>
Signed-off-by: David S. Miller <[email protected]>

diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c
index 7a501dbe7123ea78a56be5b3a6321c46e661294c..6a5b3f00f9ad329f26c1386f21d36c8656ecb147 100644 (file)
--- a/drivers/isdn/i4l/isdn_common.c
+++ b/drivers/isdn/i4l/isdn_common.c
@@ -1640,13 +1640,7 @@ isdn_ioctl(struct file *file, uint cmd, ulong arg)
                        } else
                                return -EINVAL;
                case IIOCDBGVAR:
-                       if (arg) {
-                               if (copy_to_user(argp, &dev, sizeof(ulong)))
-                                       return -EFAULT;
-                               return 0;
-                       } else
-                               return -EINVAL;
-                       break;
+                       return -EINVAL;
                default:
                        if ((cmd & IIOCDRVCTL) == IIOCDRVCTL)
                                cmd = ((cmd >> _IOC_NRSHIFT) & _IOC_NRMASK) & ISDN_DRVIOCTL_MASK;