Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1375169
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 4.4 096/210] net: irda: Fix use-after-free in irtty_open() |
| Date | 2016-04-10 22:10 +0200 |
| Message-ID | <rmtQf-22e-41@gated-at.bofh.it> (permalink) |
| References | <rmsKu-Wx-25@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Hurley <peter@hurleysoftware.com>
commit 401879c57f01cbf2da204ad2e8db910525c6dbea upstream.
The N_IRDA line discipline may access the previous line discipline's closed
and already-fre private data on open [1].
The tty->disc_data field _never_ refers to valid data on entry to the
line discipline's open() method. Rather, the ldisc is expected to
initialize that field for its own use for the lifetime of the instance
(ie. from open() to close() only).
[1]
==================================================================
BUG: KASAN: use-after-free in irtty_open+0x422/0x550 at addr ffff8800331dd068
Read of size 4 by task a.out/13960
=============================================================================
BUG kmalloc-512 (Tainted: G B ): kasan: bad access detected
-----------------------------------------------------------------------------
...
Call Trace:
[<ffffffff815fa2ae>] __asan_report_load4_noabort+0x3e/0x40 mm/kasan/report.c:279
[<ffffffff836938a2>] irtty_open+0x422/0x550 drivers/net/irda/irtty-sir.c:436
[<ffffffff829f1b80>] tty_ldisc_open.isra.2+0x60/0xa0 drivers/tty/tty_ldisc.c:447
[<ffffffff829f21c0>] tty_set_ldisc+0x1a0/0x940 drivers/tty/tty_ldisc.c:567
[< inline >] tiocsetd drivers/tty/tty_io.c:2650
[<ffffffff829da49e>] tty_ioctl+0xace/0x1fd0 drivers/tty/tty_io.c:2883
[< inline >] vfs_ioctl fs/ioctl.c:43
[<ffffffff816708ac>] do_vfs_ioctl+0x57c/0xe60 fs/ioctl.c:607
[< inline >] SYSC_ioctl fs/ioctl.c:622
[<ffffffff81671204>] SyS_ioctl+0x74/0x80 fs/ioctl.c:613
[<ffffffff852a7876>] entry_SYSCALL_64_fastpath+0x16/0x7a
Reported-and-tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/irda/irtty-sir.c | 10 ----------
1 file changed, 10 deletions(-)
--- a/drivers/net/irda/irtty-sir.c
+++ b/drivers/net/irda/irtty-sir.c
@@ -430,16 +430,6 @@ static int irtty_open(struct tty_struct
/* Module stuff handled via irda_ldisc.owner - Jean II */
- /* First make sure we're not already connected. */
- if (tty->disc_data != NULL) {
- priv = tty->disc_data;
- if (priv && priv->magic == IRTTY_MAGIC) {
- ret = -EEXIST;
- goto out;
- }
- tty->disc_data = NULL; /* ### */
- }
-
/* stop the underlying driver */
irtty_stop_receiver(tty, TRUE);
if (tty->ops->stop)
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 4.4 000/210] 4.4.7-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:10 +0200
[PATCH 4.4 025/210] EDAC/sb_edac: Fix computation of channel address Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:10 +0200
[PATCH 4.4 043/210] scsi: storvsc: fix SRB_STATUS_ABORTED handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:10 +0200
[PATCH 4.4 006/210] mmc: sh_mmcif: Correct TX DMA channel allocation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:10 +0200
[PATCH 4.4 007/210] x86/microcode/intel: Make early loader look for builtin microcode too Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:10 +0200
[PATCH 4.4 026/210] EDAC, amd64_edac: Shift wrapping issue in f1x_get_norm_dct_addr() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:10 +0200
[PATCH 4.4 016/210] KVM: VMX: avoid guest hang on invalid invvpid instruction Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:10 +0200
[PATCH 4.4 094/210] staging: comedi: ni_mio_common: fix the ni_write[blw]() functions Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:10 +0200
[PATCH 4.4 009/210] x86/entry/compat: Keep TS_COMPAT set during signal delivery Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:10 +0200
[PATCH 4.4 096/210] net: irda: Fix use-after-free in irtty_open() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:10 +0200
[PATCH 4.4 092/210] staging: comedi: ni_tiocmd: change mistaken use of start_src for start_arg Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:10 +0200
[PATCH 4.4 085/210] tpm_crb: tpm2_shutdown() must be called before tpm_chip_unregister() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:10 +0200
[PATCH 4.4 024/210] sched/preempt, sh: kmap_coherent relies on disabled preemption Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:10 +0200
[PATCH 4.4 042/210] sd: Fix discard granularity when LBPRZ=1 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:10 +0200
[PATCH 4.4 077/210] crypto: ccp - memset request context to zero during import Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:10 +0200
[PATCH 4.4 053/210] usb: hub: fix a typo in hub_port_init() leading to wrong logic Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:10 +0200
[PATCH 4.4 008/210] x86/microcode: Untangle from BLK_DEV_INITRD Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:10 +0200
[PATCH 4.4 051/210] dm: fix rq_end_stats() NULL pointer in dm_requeue_original_request() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:10 +0200
[PATCH 4.4 048/210] dm: fix excessive dm-mq context switching Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:10 +0200
[PATCH 4.4 076/210] crypto: ccp - Dont assume export/import areas are aligned Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:10 +0200
[PATCH 4.4 029/210] s390/pci: enforce fmb page boundary rule Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:10 +0200
[PATCH 4.4 091/210] HID: fix hid_ignore_special_drivers module parameter Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:10 +0200
[PATCH 4.4 022/210] Thermal: Ignore invalid trip points Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:10 +0200
[PATCH 4.4 090/210] HID: multitouch: force retrieving of Win8 signature blob Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:10 +0200
[PATCH 4.4 047/210] dm snapshot: disallow the COW and origin devices from being identical Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:10 +0200
[PATCH 4.4 044/210] be2iscsi: set the boot_kset pointer to NULL in case of failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:10 +0200
[PATCH 4.4 018/210] perf/core: Fix perf_sched_count derailment Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:20 +0200
[PATCH 4.4 001/210] s390/cpumf: Fix lpp detection Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:20 +0200
[PATCH 4.4 011/210] x86/PCI: Mark Broadwell-EP Home Agent & PCU as having non-compliant BARs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:20 +0200
[PATCH 4.4 019/210] perf tools: Dont stop PMU parsing on alias parse error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:20 +0200
[PATCH 4.4 014/210] KVM: fix spin_lock_init order on x86 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:20 +0200
[PATCH 4.4 017/210] KVM: VMX: fix nested vpid for old KVM guests Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:20 +0200
[PATCH 4.4 021/210] perf tools: Fix python extension build Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:20 +0200
[PATCH 4.4 012/210] KVM: x86: fix missed hardware breakpoints Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:20 +0200
[PATCH 4.4 004/210] ASoC: samsung: pass DMA channels as pointers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:20 +0200
[PATCH 4.4 010/210] perf/x86/intel: Add definition for PT PMI bit Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:20 +0200
[PATCH 4.4 015/210] KVM: VMX: avoid guest hang on invalid invept instruction Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:20 +0200
[PATCH 4.4 005/210] mmc: sh_mmcif: rework dma channel handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:20 +0200
[PATCH 4.4 020/210] perf tools: Fix checking asprintf return value Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:20 +0200
[PATCH 4.4 002/210] regulator: core: avoid unused variable warning Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:20 +0200
[PATCH 4.4 028/210] s390/cpumf: add missing lpp magic initialization Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:40 +0200
[PATCH 4.4 182/210] clk: rockchip: add hclk_cpubus to the list of rk3188 critical clocks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:40 +0200
[PATCH 4.4 170/210] kbuild/mkspec: fix grub2 installkernel issue Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:40 +0200
[PATCH 4.4 069/210] ALSA: usb-audio: Minor code cleanup in create_fixed_stream_quirk() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:40 +0200
[PATCH 4.4 073/210] Bluetooth: btusb: Add a new AR3012 ID 13d3:3472 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:40 +0200
[PATCH 4.4 188/210] iser-target: Rework connection termination Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:40 +0200
[PATCH 4.4 178/210] clk: rockchip: rk3368: fix cpuclk mux bit of big cpu-cluster Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:40 +0200
[PATCH 4.4 037/210] x86/mm: TLB_REMOTE_SEND_IPI should count pages Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:50 +0200
Re: [PATCH 4.4 159/210] drm/radeon: disable runtime pm on PX laptops without dGPU power control Michel Dänzer <michel@daenzer.net> - 2016-04-11 04:40 +0200
Re: [PATCH 4.4 159/210] drm/radeon: disable runtime pm on PX laptops without dGPU power control Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-12 16:20 +0200
Re: [PATCH 4.4 159/210] drm/radeon: disable runtime pm on PX laptops without dGPU power control Michel Dänzer <michel@daenzer.net> - 2016-04-13 06:00 +0200
Re: [PATCH 4.4 159/210] drm/radeon: disable runtime pm on PX laptops without dGPU power control Michel Dänzer <michel@daenzer.net> - 2016-04-14 04:50 +0200
Re: [PATCH 4.4 159/210] drm/radeon: disable runtime pm on PX laptops without dGPU power control Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-14 16:30 +0200
Re: [PATCH 4.4 000/210] 4.4.7-stable review Guenter Roeck <linux@roeck-us.net> - 2016-04-11 05:20 +0200
Re: [PATCH 4.4 000/210] 4.4.7-stable review shuahkh <shuahkh@osg.sisa.samsung.com> - 2016-04-11 19:30 +0200
csiph-web