Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1371053
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 3.13.y-ckt 07/97] net: irda: Fix use-after-free in irtty_open() |
| Date | 2016-04-05 02:00 +0200 |
| Message-ID | <rkmzx-2ph-29@gated-at.bofh.it> (permalink) |
| References | <rkm6u-2bK-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
3.13.11-ckt38 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Peter Hurley <peter@hurleysoftware.com>
commit 401879c57f01cbf2da204ad2e8db910525c6dbea upstream.
The N_IRDA line discipline may access the previous line discipline's closed
and already-fre private data on open [1].
The tty->disc_data field _never_ refers to valid data on entry to the
line discipline's open() method. Rather, the ldisc is expected to
initialize that field for its own use for the lifetime of the instance
(ie. from open() to close() only).
[1]
==================================================================
BUG: KASAN: use-after-free in irtty_open+0x422/0x550 at addr ffff8800331dd068
Read of size 4 by task a.out/13960
=============================================================================
BUG kmalloc-512 (Tainted: G B ): kasan: bad access detected
-----------------------------------------------------------------------------
...
Call Trace:
[<ffffffff815fa2ae>] __asan_report_load4_noabort+0x3e/0x40 mm/kasan/report.c:279
[<ffffffff836938a2>] irtty_open+0x422/0x550 drivers/net/irda/irtty-sir.c:436
[<ffffffff829f1b80>] tty_ldisc_open.isra.2+0x60/0xa0 drivers/tty/tty_ldisc.c:447
[<ffffffff829f21c0>] tty_set_ldisc+0x1a0/0x940 drivers/tty/tty_ldisc.c:567
[< inline >] tiocsetd drivers/tty/tty_io.c:2650
[<ffffffff829da49e>] tty_ioctl+0xace/0x1fd0 drivers/tty/tty_io.c:2883
[< inline >] vfs_ioctl fs/ioctl.c:43
[<ffffffff816708ac>] do_vfs_ioctl+0x57c/0xe60 fs/ioctl.c:607
[< inline >] SYSC_ioctl fs/ioctl.c:622
[<ffffffff81671204>] SyS_ioctl+0x74/0x80 fs/ioctl.c:613
[<ffffffff852a7876>] entry_SYSCALL_64_fastpath+0x16/0x7a
Reported-and-tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/net/irda/irtty-sir.c | 10 ----------
1 file changed, 10 deletions(-)
diff --git a/drivers/net/irda/irtty-sir.c b/drivers/net/irda/irtty-sir.c
index 177441a..aef74c6 100644
--- a/drivers/net/irda/irtty-sir.c
+++ b/drivers/net/irda/irtty-sir.c
@@ -430,16 +430,6 @@ static int irtty_open(struct tty_struct *tty)
/* Module stuff handled via irda_ldisc.owner - Jean II */
- /* First make sure we're not already connected. */
- if (tty->disc_data != NULL) {
- priv = tty->disc_data;
- if (priv && priv->magic == IRTTY_MAGIC) {
- ret = -EEXIST;
- goto out;
- }
- tty->disc_data = NULL; /* ### */
- }
-
/* stop the underlying driver */
irtty_stop_receiver(tty, TRUE);
if (tty->ops->stop)
--
2.7.4
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[3.13.y-ckt stable] Linux 3.13.11-ckt38 stable review Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:30 +0200 [PATCH 3.13.y-ckt 26/97] quota: Fix possible GPF due to uninitialised pointers Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:30 +0200 [PATCH 3.13.y-ckt 68/97] tracing: Fix trace_printk() to print when not using bprintk() Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:30 +0200 [PATCH 3.13.y-ckt 21/97] Bluetooth: btusb: Add a new AR3012 ID 04ca:3014 Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:30 +0200 [PATCH 3.13.y-ckt 93/97] paride: make 'verbose' parameter an 'int' again Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:30 +0200 [PATCH 3.13.y-ckt 08/97] usb: retry reset if a device times out Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:30 +0200 [PATCH 3.13.y-ckt 09/97] HID: core: do not scan reports if the group is already set Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:30 +0200 [PATCH 3.13.y-ckt 02/97] EDAC, amd64_edac: Shift wrapping issue in f1x_get_norm_dct_addr() Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:30 +0200 [PATCH 3.13.y-ckt 41/97] iser-target: Separate flows for np listeners and connections cma events Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:30 +0200 [PATCH 3.13.y-ckt 86/97] rtc: vr41xx: Wire up alarm_irq_enable Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:30 +0200 [PATCH 3.13.y-ckt 01/97] [stable-only] pipe: Fix buffer offset after partially failed read Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:30 +0200 [PATCH 3.13.y-ckt 70/97] rapidio/rionet: fix deadlock on SMP Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:40 +0200 [PATCH 3.13.y-ckt 50/97] ALSA: hda - Fix unconditional GPIO toggle via automute Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:40 +0200 [PATCH 3.13.y-ckt 84/97] mtd: map: fix .set_vpp() documentation Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:40 +0200 [PATCH 3.13.y-ckt 81/97] net/mlx5: Make command timeout way shorter Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:40 +0200 [PATCH 3.13.y-ckt 72/97] MAINTAINERS: Update mailing list and web page for hwmon subsystem Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:40 +0200 [PATCH 3.13.y-ckt 79/97] ethernet: micrel: fix some error codes Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:40 +0200 [PATCH 3.13.y-ckt 69/97] fs/coredump: prevent fsuid=0 dumps into user-controlled directories Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:40 +0200 [PATCH 3.13.y-ckt 75/97] clk: xgene: Add missing parenthesis when clearing divider value Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:40 +0200 [PATCH 3.13.y-ckt 96/97] drivers/misc/ad525x_dpot: AD5274 fix RDAC read back errors Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:40 +0200 [PATCH 3.13.y-ckt 54/97] x86/iopl: Fix iopl capability check on Xen PV Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:40 +0200 [PATCH 3.13.y-ckt 90/97] ASoC: s3c24xx: use const snd_soc_component_driver pointer Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:40 +0200 [PATCH 3.13.y-ckt 89/97] lpfc: fix misleading indentation Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:40 +0200 [PATCH 3.13.y-ckt 94/97] ppp: ensure file->private_data can't be overridden Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:40 +0200 [PATCH 3.13.y-ckt 83/97] ath9k: fix buffer overrun for ar9287 Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:40 +0200 [PATCH 3.13.y-ckt 63/97] tracing: Fix crash from reading trace_pipe with sendfile Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:40 +0200 [PATCH 3.13.y-ckt 65/97] target: Fix target_release_cmd_kref shutdown comp leak Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:40 +0200 [PATCH 3.13.y-ckt 77/97] mdio-sun4i: oops in error handling in probe Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:40 +0200 [PATCH 3.13.y-ckt 92/97] nbd: ratelimit error msgs after socket close Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:40 +0200 [PATCH 3.13.y-ckt 66/97] KVM: VMX: avoid guest hang on invalid invept instruction Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:40 +0200 [PATCH 3.13.y-ckt 95/97] clk: versatile: sp810: support reentrance Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:40 +0200 [PATCH 3.13.y-ckt 62/97] tracing: Have preempt(irqs)off trace preempt disabled functions Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:40 +0200 [PATCH 3.13.y-ckt 82/97] ipvs: correct initial offset of Call-ID header search in SIP persistence engine Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:40 +0200 [PATCH 3.13.y-ckt 76/97] ppp: take reference on channels netns Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:40 +0200 [PATCH 3.13.y-ckt 85/97] ARM: OMAP3: Add cpuidle parameters table for omap3430 Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:40 +0200 [PATCH 3.13.y-ckt 78/97] net: Fix use after free in the recvmmsg exit path Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:40 +0200 [PATCH 3.13.y-ckt 91/97] kbuild/mkspec: fix grub2 installkernel issue Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:40 +0200 [PATCH 3.13.y-ckt 88/97] ipv4: fix broadcast packets reception Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:40 +0200 [PATCH 3.13.y-ckt 97/97] perf stat: Document --detailed option Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:40 +0200 [PATCH 3.13.y-ckt 61/97] USB: uas: Reduce can_queue to MAX_CMNDS Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:40 +0200 [PATCH 3.13.y-ckt 74/97] ocfs2/dlm: fix BUG in dlm_move_lockres_to_recovery_list Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:40 +0200 [PATCH 3.13.y-ckt 64/97] splice: handle zero nr_pages in splice_to_pipe() Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:40 +0200 [PATCH 3.13.y-ckt 44/97] bus: imx-weim: Take the 'status' property value into account Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:50 +0200 [PATCH 3.13.y-ckt 40/97] Bluetooth: btusb: Add a new AR3012 ID 13d3:3472 Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:50 +0200 [PATCH 3.13.y-ckt 24/97] watchdog: rc32434_wdt: fix ioctl error handling Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:50 +0200 [PATCH 3.13.y-ckt 37/97] drm/radeon: Don't drop DP 2.7 Ghz link setup on some cards. Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:50 +0200 [PATCH 3.13.y-ckt 43/97] xtensa: clear all DBREAKC registers on start Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:50 +0200 [PATCH 3.13.y-ckt 33/97] perf/x86/intel: Use PAGE_SIZE for PEBS buffer size on Core2 Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:50 +0200 [PATCH 3.13.y-ckt 51/97] ALSA: usb-audio: Fix NULL dereference in create_fixed_stream_quirk() Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:50 +0200 [PATCH 3.13.y-ckt 59/97] USB: usb_driver_claim_interface: add sanity checking Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:50 +0200 [PATCH 3.13.y-ckt 53/97] nfsd: fix deadlock secinfo+readdir compound Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:50 +0200 [PATCH 3.13.y-ckt 35/97] x86/PCI: Mark Broadwell-EP Home Agent & PCU as having non-compliant BARs Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:50 +0200 [PATCH 3.13.y-ckt 23/97] [media] bttv: Width must be a multiple of 16 when capturing planar formats Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:50 +0200 [PATCH 3.13.y-ckt 52/97] ALSA: usb-audio: Add sanity checks for endpoint accesses Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:50 +0200 [PATCH 3.13.y-ckt 46/97] s390/pci: enforce fmb page boundary rule Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:50 +0200 [PATCH 3.13.y-ckt 27/97] mtip32xx: Print exact time when an internal command is interrupted Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:50 +0200 [PATCH 3.13.y-ckt 57/97] x86/apic: Fix suspicious RCU usage in smp_trace_call_function_interrupt() Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:50 +0200 [PATCH 3.13.y-ckt 49/97] HID: i2c-hid: fix OOB write in i2c_hid_set_or_send_report() Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:50 +0200 [PATCH 3.13.y-ckt 34/97] bcache: fix cache_set_flush() NULL pointer dereference on OOM Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:50 +0200 [PATCH 3.13.y-ckt 45/97] ALSA: intel8x0: Add clock quirk entry for AD1981B on IBM ThinkPad X41. Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:50 +0200 [PATCH 3.13.y-ckt 39/97] jbd2: fix FS corruption possibility in jbd2_journal_destroy() on umount path Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:50 +0200 [PATCH 3.13.y-ckt 31/97] pinctrl-bcm2835: Fix cut-and-paste error in "pull" parsing Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:50 +0200 [PATCH 3.13.y-ckt 56/97] Input: synaptics - handle spurious release of trackstick buttons, again Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:50 +0200 [PATCH 3.13.y-ckt 55/97] Input: ims-pcu - sanity check against missing interfaces Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:50 +0200 [PATCH 3.13.y-ckt 28/97] KVM: i8254: change PIT discard tick policy Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:50 +0200 [PATCH 3.13.y-ckt 25/97] xfs: fix two memory leaks in xfs_attr_list.c error paths Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:50 +0200 [PATCH 3.13.y-ckt 58/97] USB: iowarrior: fix oops with malicious USB descriptors Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:50 +0200 [PATCH 3.13.y-ckt 60/97] USB: cdc-acm: more sanity checking Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:50 +0200 [PATCH 3.13.y-ckt 47/97] Input: powermate - fix oops with malicious USB descriptors Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:50 +0200 [PATCH 3.13.y-ckt 48/97] net: mvneta: enable change MAC address when interface is up Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:50 +0200 [PATCH 3.13.y-ckt 38/97] sg: fix dxferp in from_to case Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:50 +0200 [PATCH 3.13.y-ckt 42/97] xtensa: ISS: don't hang if stdin EOF is reached Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:50 +0200 [PATCH 3.13.y-ckt 30/97] rt2x00: add new rt2800usb device Buffalo WLI-UC-G450 Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:50 +0200 [PATCH 3.13.y-ckt 36/97] be2iscsi: set the boot_kset pointer to NULL in case of failure Kamal Mostafa <kamal@canonical.com> - 2016-04-05 01:50 +0200 [PATCH 3.13.y-ckt 22/97] IB/srpt: Simplify srpt_handle_tsk_mgmt() Kamal Mostafa <kamal@canonical.com> - 2016-04-05 02:00 +0200 [PATCH 3.13.y-ckt 06/97] 8250: use callbacks to access UART_DLL/UART_DLM Kamal Mostafa <kamal@canonical.com> - 2016-04-05 02:00 +0200 [PATCH 3.13.y-ckt 05/97] [media] pwc: Add USB id for Philips Spc880nc webcam Kamal Mostafa <kamal@canonical.com> - 2016-04-05 02:00 +0200 [PATCH 3.13.y-ckt 11/97] scripts/coccinelle: modernize & Kamal Mostafa <kamal@canonical.com> - 2016-04-05 02:00 +0200 [PATCH 3.13.y-ckt 12/97] [media] adv7511: TX_EDID_PRESENT is still 1 after a disconnect Kamal Mostafa <kamal@canonical.com> - 2016-04-05 02:00 +0200 [PATCH 3.13.y-ckt 13/97] [media] saa7134: Fix bytesperline not being set correctly for planar formats Kamal Mostafa <kamal@canonical.com> - 2016-04-05 02:00 +0200 [PATCH 3.13.y-ckt 03/97] tty: Fix GPF in flush_to_ldisc(), part 2 Kamal Mostafa <kamal@canonical.com> - 2016-04-05 02:00 +0200 [PATCH 3.13.y-ckt 14/97] perf tools: Dont stop PMU parsing on alias parse error Kamal Mostafa <kamal@canonical.com> - 2016-04-05 02:00 +0200 [PATCH 3.13.y-ckt 20/97] md/raid5: Compare apples to apples (or sectors to sectors) Kamal Mostafa <kamal@canonical.com> - 2016-04-05 02:00 +0200 [PATCH 3.13.y-ckt 04/97] [media] media: v4l2-compat-ioctl32: fix missing length copy in put_v4l2_buffer32 Kamal Mostafa <kamal@canonical.com> - 2016-04-05 02:00 +0200 [PATCH 3.13.y-ckt 07/97] net: irda: Fix use-after-free in irtty_open() Kamal Mostafa <kamal@canonical.com> - 2016-04-05 02:00 +0200 [PATCH 3.13.y-ckt 15/97] Bluetooth: btusb: Add new AR3012 ID 13d3:3395 Kamal Mostafa <kamal@canonical.com> - 2016-04-05 02:00 +0200 [PATCH 3.13.y-ckt 17/97] aacraid: Fix memory leak in aac_fib_map_free Kamal Mostafa <kamal@canonical.com> - 2016-04-05 02:00 +0200 [PATCH 3.13.y-ckt 18/97] mtd: onenand: fix deadlock in onenand_block_markbad Kamal Mostafa <kamal@canonical.com> - 2016-04-05 02:00 +0200 [PATCH 3.13.y-ckt 16/97] Bluetooth: Add new AR3012 ID 0489:e095 Kamal Mostafa <kamal@canonical.com> - 2016-04-05 02:00 +0200 [PATCH 3.13.y-ckt 19/97] PCI: Disable IO/MEM decoding for devices with non-compliant BARs Kamal Mostafa <kamal@canonical.com> - 2016-04-05 02:00 +0200 [PATCH 3.13.y-ckt 10/97] HID: fix hid_ignore_special_drivers module parameter Kamal Mostafa <kamal@canonical.com> - 2016-04-05 02:00 +0200
csiph-web