Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1525947

[PATCH 4.4 17/37] tty: Prevent ldisc drivers from re-using stale tty fields

Show all headers | View raw

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Peter Hurley <peter@hurleysoftware.com>

commit dd42bf1197144ede075a9d4793123f7689e164bc upstream.

Line discipline drivers may mistakenly misuse ldisc-related fields
when initializing. For example, a failure to initialize tty->receive_room
in the N_GIGASET_M101 line discipline was recently found and fixed [1].
Now, the N_X25 line discipline has been discovered accessing the previous
line discipline's already-freed private data [2].

Harden the ldisc interface against misuse by initializing revelant
tty fields before instancing the new line discipline.

[1]
    commit fd98e9419d8d622a4de91f76b306af6aa627aa9c
    Author: Tilman Schmidt <tilman@imap.cc>
    Date:   Tue Jul 14 00:37:13 2015 +0200

    isdn/gigaset: reset tty->receive_room when attaching ser_gigaset

[2] Report from Sasha Levin <sasha.levin@oracle.com>
    [  634.336761] ==================================================================
    [  634.338226] BUG: KASAN: use-after-free in x25_asy_open_tty+0x13d/0x490 at addr ffff8800a743efd0
    [  634.339558] Read of size 4 by task syzkaller_execu/8981
    [  634.340359] =============================================================================
    [  634.341598] BUG kmalloc-512 (Not tainted): kasan: bad access detected
    ...
    [  634.405018] Call Trace:
    [  634.405277] dump_stack (lib/dump_stack.c:52)
    [  634.405775] print_trailer (mm/slub.c:655)
    [  634.406361] object_err (mm/slub.c:662)
    [  634.406824] kasan_report_error (mm/kasan/report.c:138 mm/kasan/report.c:236)
    [  634.409581] __asan_report_load4_noabort (mm/kasan/report.c:279)
    [  634.411355] x25_asy_open_tty (drivers/net/wan/x25_asy.c:559 (discriminator 1))
    [  634.413997] tty_ldisc_open.isra.2 (drivers/tty/tty_ldisc.c:447)
    [  634.414549] tty_set_ldisc (drivers/tty/tty_ldisc.c:567)
    [  634.415057] tty_ioctl (drivers/tty/tty_io.c:2646 drivers/tty/tty_io.c:2879)
    [  634.423524] do_vfs_ioctl (fs/ioctl.c:43 fs/ioctl.c:607)
    [  634.427491] SyS_ioctl (fs/ioctl.c:622 fs/ioctl.c:613)
    [  634.427945] entry_SYSCALL_64_fastpath (arch/x86/entry/entry_64.S:188)

Cc: Tilman Schmidt <tilman@imap.cc>
Cc: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Cc: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/tty/tty_ldisc.c |    7 +++++++
 1 file changed, 7 insertions(+)

--- a/drivers/tty/tty_ldisc.c
+++ b/drivers/tty/tty_ldisc.c
@@ -417,6 +417,10 @@ EXPORT_SYMBOL_GPL(tty_ldisc_flush);
  *	they are not on hot paths so a little discipline won't do
  *	any harm.
  *
+ *	The line discipline-related tty_struct fields are reset to
+ *	prevent the ldisc driver from re-using stale information for
+ *	the new ldisc instance.
+ *
  *	Locking: takes termios_rwsem
  */
 
@@ -425,6 +429,9 @@ static void tty_set_termios_ldisc(struct
 	down_write(&tty->termios_rwsem);
 	tty->termios.c_line = num;
 	up_write(&tty->termios_rwsem);
+
+	tty->disc_data = NULL;
+	tty->receive_room = 0;
 }
 
 /**

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.4 00/37] 4.4.34-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 31/37] sparc64: Convert U1copy_{from,to}_user to accurate exception reporting. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 02/37] net: clear sk_err_soft in sk_clone_lock() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 12/37] fib_trie: Correct /proc/net/route off by one error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 27/37] sparc64: Delete __ret_efault. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 25/37] sparc64: Fix illegal relative branches in hypervisor patched TLB cross-call code. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 10/37] ipv6: dccp: add missing bind_conflict to dccp_ipv6_mapped Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 32/37] sparc64: Convert NG4copy_{from,to}_user to accurate exception reporting. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 24/37] sparc64: Fix instruction count in comment for __hypervisor_flush_tlb_pending. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 07/37] dccp: do not send reset to already closed sockets Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 14/37] net: __skb_flow_dissect() must cap its return value Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 30/37] sparc64: Convert GENcopy_{from,to}_user to accurate exception reporting. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 05/37] ip6_tunnel: Clear IP6CB in ip6tunnel_xmit() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 35/37] sparc64: Convert U3copy_{from,to}_user to accurate exception reporting. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 33/37] sparc64: Convert NGcopy_{from,to}_user to accurate exception reporting. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 11/37] sctp: assign assoc_id earlier in __sctp_connect Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 19/37] sparc: serial: sunhv: fix a double lock bug Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 16/37] tcp: take care of truncations done by sk_filter() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 23/37] sparc64: Fix illegal relative branches in hypervisor patched TLB code. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 36/37] sparc64: Delete now unused user copy assembler helpers. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:40 +0100
  [PATCH 4.4 09/37] ipv6: dccp: fix out of bound access in dccp_v6_err() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:40 +0100
  [PATCH 4.4 17/37] tty: Prevent ldisc drivers from re-using stale tty fields Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:40 +0100
  [PATCH 4.4 26/37] sparc64: Handle extremely large kernel TLB range flushes more gracefully. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:40 +0100
  [PATCH 4.4 29/37] sparc64: Convert copy_in_user to accurate exception reporting. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:40 +0100
  [PATCH 4.4 34/37] sparc64: Convert NG2copy_{from,to}_user to accurate exception reporting. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:40 +0100
  [PATCH 4.4 15/37] ipv4: use new_gw for redirect neigh lookup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:40 +0100
  [PATCH 4.4 37/37] sparc64: Delete now unused user copy fixup functions. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:40 +0100
  [PATCH 4.4 01/37] dctcp: avoid bogus doubling of cwnd after loss Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:50 +0100
  [PATCH 4.4 20/37] sparc64 mm: Fix base TSB sizing when hugetlb pages are used Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:50 +0100
  [PATCH 4.4 04/37] bgmac: stop clearing DMA receive control register right after it is set Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:50 +0100
  [PATCH 4.4 21/37] sparc: Handle negative offsets in arch_jump_label_transform Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:50 +0100
  [PATCH 4.4 08/37] dccp: fix out of bound access in dccp_v4_err() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:50 +0100
  [PATCH 4.4 22/37] sparc64: Handle extremely large kernel TSB range flushes sanely. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:50 +0100
  Re: [PATCH 4.4 00/37] 4.4.34-stable review Guenter Roeck <linux@roeck-us.net> - 2016-11-19 17:30 +0100
  Re: [PATCH 4.4 00/37] 4.4.34-stable review Shuah Khan <shuah.kh@samsung.com> - 2016-11-21 17:40 +0100
    Re: [PATCH 4.4 00/37] 4.4.34-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-21 17:50 +0100

csiph-web