Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1297968
| From | Ben Hutchings <ben@decadent.org.uk> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 3.2 40/77] wan/x25: Fix use-after-free in x25_asy_open_tty() |
| Date | 2015-12-24 17:10 +0100 |
| Message-ID | <qJgCL-u9-15@gated-at.bofh.it> (permalink) |
| References | <qJgjn-6R-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
3.2.75-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Peter Hurley <peter@hurleysoftware.com>
commit ee9159ddce14bc1dec9435ae4e3bd3153e783706 upstream.
The N_X25 line discipline may access the previous line discipline's closed
and already-freed private data on open [1].
The tty->disc_data field _never_ refers to valid data on entry to the
line discipline's open() method. Rather, the ldisc is expected to
initialize that field for its own use for the lifetime of the instance
(ie. from open() to close() only).
[1]
[ 634.336761] ==================================================================
[ 634.338226] BUG: KASAN: use-after-free in x25_asy_open_tty+0x13d/0x490 at addr ffff8800a743efd0
[ 634.339558] Read of size 4 by task syzkaller_execu/8981
[ 634.340359] =============================================================================
[ 634.341598] BUG kmalloc-512 (Not tainted): kasan: bad access detected
...
[ 634.405018] Call Trace:
[ 634.405277] dump_stack (lib/dump_stack.c:52)
[ 634.405775] print_trailer (mm/slub.c:655)
[ 634.406361] object_err (mm/slub.c:662)
[ 634.406824] kasan_report_error (mm/kasan/report.c:138 mm/kasan/report.c:236)
[ 634.409581] __asan_report_load4_noabort (mm/kasan/report.c:279)
[ 634.411355] x25_asy_open_tty (drivers/net/wan/x25_asy.c:559 (discriminator 1))
[ 634.413997] tty_ldisc_open.isra.2 (drivers/tty/tty_ldisc.c:447)
[ 634.414549] tty_set_ldisc (drivers/tty/tty_ldisc.c:567)
[ 634.415057] tty_ioctl (drivers/tty/tty_io.c:2646 drivers/tty/tty_io.c:2879)
[ 634.423524] do_vfs_ioctl (fs/ioctl.c:43 fs/ioctl.c:607)
[ 634.427491] SyS_ioctl (fs/ioctl.c:622 fs/ioctl.c:613)
[ 634.427945] entry_SYSCALL_64_fastpath (arch/x86/entry/entry_64.S:188)
Reported-and-tested-by: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/net/wan/x25_asy.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
--- a/drivers/net/wan/x25_asy.c
+++ b/drivers/net/wan/x25_asy.c
@@ -547,16 +547,12 @@ static void x25_asy_receive_buf(struct t
static int x25_asy_open_tty(struct tty_struct *tty)
{
- struct x25_asy *sl = tty->disc_data;
+ struct x25_asy *sl;
int err;
if (tty->ops->write == NULL)
return -EOPNOTSUPP;
- /* First make sure we're not already connected. */
- if (sl && sl->magic == X25_ASY_MAGIC)
- return -EEXIST;
-
/* OK. Find a free X.25 channel to use. */
sl = x25_asy_alloc();
if (sl == NULL)
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 3.2 00/77] 3.2.75-rc1 review Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 16:50 +0100
[PATCH 3.2 43/77] dm btree: fix leak of bufio-backed block in btree_split_sibling error path Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
[PATCH 3.2 73/77] bluetooth: Validate socket address length in sco_sock_bind(). Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
[PATCH 3.2 31/77] broadcom: fix PHY_ID_BCM5481 entry in the id table Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
[PATCH 3.2 08/77] USB: ti_usb_3410_502: Fix ID table size Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
[PATCH 3.2 04/77] ALSA: usb-audio: prevent CH345 multiport output SysEx corruption Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
[PATCH 3.2 76/77] isdn_ppp: Add checks for allocation failure in isdn_ppp_open() Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
[PATCH 3.2 18/77] USB: option: add XS Stick W100-2 from 4G Systems Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
[PATCH 3.2 28/77] fix sysvfs symlinks Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
[PATCH 3.2 56/77] mm, vmstat: allow WQ concurrency to discover memory reclaim doesn't make any progress Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
[PATCH 3.2 22/77] net: ip6mr: fix static mfc/dev leaks on table destruction Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
[PATCH 3.2 37/77] drm/ttm: Fixed a read/write lock imbalance Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
[PATCH 3.2 52/77] ipmi: move timer init to before irq is setup Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
[PATCH 3.2 50/77] ALSA: rme96: Fix unexpected volume reset after rate changes Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
[PATCH 3.2 64/77] dccp: remove unnecessary codes in ipv6.c Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
[PATCH 3.2 68/77] sctp: update the netstamp_needed counter when copying sockets Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
[PATCH 3.2 16/77] xhci: Add XHCI_INTEL_HOST quirk Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
[PATCH 3.2 15/77] macvlan: fix leak in macvlan_handle_frame Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
[PATCH 3.2 65/77] ipv6: add complete rcu protection around np->opt Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
[PATCH 3.2 09/77] USB: ti_usb_3410_5052: Add Honeywell HGI80 ID Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
[PATCH 3.2 17/77] xhci: Workaround to get Intel xHCI reset working more reliably Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
[PATCH 3.2 05/77] ALSA: usb-audio: work around CH345 input SysEx corruption Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
[PATCH 3.2 67/77] atl1c: Improve driver not to do order 4 GFP_ATOMIC allocation Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
[PATCH 3.2 19/77] usblp: do not set TASK_INTERRUPTIBLE before lock Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
[PATCH 3.2 55/77] parisc iommu: fix panic due to trying to allocate too large region Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
[PATCH 3.2 62/77] net: ipmr: fix static mfc/dev leaks on table destruction Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
[PATCH 3.2 30/77] vfs: Avoid softlockups with sendfile(2) Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
[PATCH 3.2 10/77] usb: musb: core: fix order of arguments to ulpi write callback Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
[PATCH 3.2 59/77] snmp: Remove duplicate OUTMCAST stat increment Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
[PATCH 3.2 24/77] USB: cp210x: Remove CP2110 ID from compatibility list Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
[PATCH 3.2 46/77] drm: Fix an unwanted master inheritance v2 Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
Re: [PATCH 3.2 46/77] drm: Fix an unwanted master inheritance v2 Thomas Hellstrom <thellstrom@vmware.com> - 2015-12-25 15:20 +0100
Re: [PATCH 3.2 46/77] drm: Fix an unwanted master inheritance v2 Ben Hutchings <ben@decadent.org.uk> - 2015-12-26 05:40 +0100
[PATCH 3.2 66/77] ipv6: sctp: implement sctp_v6_destroy_sock() Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
[PATCH 3.2 06/77] USB: serial: option: add support for Novatel MiFi USB620L Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
[PATCH 3.2 71/77] sh_eth: fix kernel oops in skb_put() Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
[PATCH 3.2 14/77] mac80211: mesh: fix call_rcu() usage Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:00 +0100
[PATCH 3.2 49/77] usb: xhci: fix config fail of FS hub behind a HS hub with MTT Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:10 +0100
[PATCH 3.2 54/77] vgaarb: fix signal handling in vga_get() Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:10 +0100
[PATCH 3.2 58/77] sh64: fix __NR_fgetxattr Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:10 +0100
[PATCH 3.2 70/77] net: add validation for the socket syscall protocol argument Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:10 +0100
[PATCH 3.2 40/77] wan/x25: Fix use-after-free in x25_asy_open_tty() Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:10 +0100
[PATCH 3.2 44/77] ipv4: igmp: Allow removing groups from a removed interface Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:10 +0100
[PATCH 3.2 03/77] ALSA: usb-audio: add packet size quirk for the Medeli DD305 Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:10 +0100
[PATCH 3.2 53/77] dm btree: fix bufio buffer leaks in dm_btree_del() error path Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:10 +0100
[PATCH 3.2 74/77] af_unix: Revert 'lock_interruptible' in stream receive code Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:10 +0100
[PATCH 3.2 47/77] sched/core: Remove false-positive warning from wake_up_process() Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:10 +0100
[PATCH 3.2 75/77] af_unix: fix a fatal race with bit fields Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:10 +0100
[PATCH 3.2 45/77] locking: Add WARN_ON_ONCE lock assertion Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:10 +0100
[PATCH 3.2 35/77] RDS: fix race condition when sending a message on unbound socket Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:10 +0100
[PATCH 3.2 77/77] ppp, slip: Validate VJ compression slot parameters completely Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:10 +0100
[PATCH 3.2 41/77] USB: whci-hcd: add check for dma mapping error Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:10 +0100
[PATCH 3.2 51/77] 9p: ->evict_inode() should kick out ->i_data, not ->i_mapping Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:10 +0100
[PATCH 3.2 38/77] AHCI: Fix softreset failed issue of Port Multiplier Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:10 +0100
[PATCH 3.2 39/77] sata_sil: disable trim Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:10 +0100
[PATCH 3.2 36/77] nfs: if we have no valid attrs, then don't declare the attribute cache valid Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 17:10 +0100
Re: [PATCH 3.2 00/77] 3.2.75-rc1 review Guenter Roeck <linux@roeck-us.net> - 2015-12-24 23:30 +0100
Re: [PATCH 3.2 00/77] 3.2.75-rc1 review Ben Hutchings <ben@decadent.org.uk> - 2015-12-24 23:40 +0100
csiph-web