isdn: Disable IIOCDBGVAR
authorKees Cook <keescook@chromium.org>
Wed, 15 Aug 2018 19:14:05 +0000 (12:14 -0700)
committerDavid S. Miller <davem@davemloft.net>
Thu, 16 Aug 2018 19:26:24 +0000 (12:26 -0700)
commit5e22002aa8809e2efab2da95855f73f63e14a36c
tree24061c231a0719289e9613c3654132faafbf54b1
parent45316818371d1fb3ecbffa4d4a2d0550e1822e92
isdn: Disable IIOCDBGVAR

It was possible to directly leak the kernel address where the isdn_dev
structure pointer was stored. This is a kernel ASLR bypass for anyone
with access to the ioctl. The code had been present since the beginning
of git history, though this shouldn't ever be needed for normal operation,
therefore remove it.

Reported-by: Al Viro <viro@zeniv.linux.org.uk>
Cc: Karsten Keil <isdn@linux-pingi.de>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/isdn/i4l/isdn_common.c