Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1649630
| From | Alan Cox <gnomes@lxorguk.ukuu.org.uk> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | Re: [PATCH 3.18 34/59] tty: Prevent ldisc drivers from re-using stale tty fields |
| Date | 2017-05-24 15:50 +0200 |
| Message-ID | <tKEPM-2YG-15@gated-at.bofh.it> (permalink) |
| References | <tKpe1-rD-7@gated-at.bofh.it> <tKpe4-rD-75@gated-at.bofh.it> |
| Organization | Intel Corporation |
On Tue, 23 May 2017 22:10:02 +0200 Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote: > 3.18-stable review patch. If anyone has any objections, please let me know. > Thiis is a patch designed to cause a crash in order to stop future errors occurring. It seems less than ideal as a stable candidate. > ------------------ > > From: Peter Hurley <peter@hurleysoftware.com> > > commit dd42bf1197144ede075a9d4793123f7689e164bc upstream. > > Line discipline drivers may mistakenly misuse ldisc-related fields > when initializing. For example, a failure to initialize tty->receive_room > in the N_GIGASET_M101 line discipline was recently found and fixed [1]. > Now, the N_X25 line discipline has been discovered accessing the previous > line discipline's already-freed private data [2]. > > Harden the ldisc interface against misuse by initializing revelant > tty fields before instancing the new line discipline. > > [1] > commit fd98e9419d8d622a4de91f76b306af6aa627aa9c > Author: Tilman Schmidt <tilman@imap.cc> > Date: Tue Jul 14 00:37:13 2015 +0200 > > isdn/gigaset: reset tty->receive_room when attaching ser_gigaset > > [2] Report from Sasha Levin <sasha.levin@oracle.com> > [ 634.336761] ================================================================== > [ 634.338226] BUG: KASAN: use-after-free in x25_asy_open_tty+0x13d/0x490 at addr ffff8800a743efd0 > [ 634.339558] Read of size 4 by task syzkaller_execu/8981 > [ 634.340359] ============================================================================= > [ 634.341598] BUG kmalloc-512 (Not tainted): kasan: bad access detected > ... > [ 634.405018] Call Trace: > [ 634.405277] dump_stack (lib/dump_stack.c:52) > [ 634.405775] print_trailer (mm/slub.c:655) > [ 634.406361] object_err (mm/slub.c:662) > [ 634.406824] kasan_report_error (mm/kasan/report.c:138 mm/kasan/report.c:236) > [ 634.409581] __asan_report_load4_noabort (mm/kasan/report.c:279) > [ 634.411355] x25_asy_open_tty (drivers/net/wan/x25_asy.c:559 (discriminator 1)) > [ 634.413997] tty_ldisc_open.isra.2 (drivers/tty/tty_ldisc.c:447) > [ 634.414549] tty_set_ldisc (drivers/tty/tty_ldisc.c:567) > [ 634.415057] tty_ioctl (drivers/tty/tty_io.c:2646 drivers/tty/tty_io.c:2879) > [ 634.423524] do_vfs_ioctl (fs/ioctl.c:43 fs/ioctl.c:607) > [ 634.427491] SyS_ioctl (fs/ioctl.c:622 fs/ioctl.c:613) > [ 634.427945] entry_SYSCALL_64_fastpath (arch/x86/entry/entry_64.S:188) > > Cc: Tilman Schmidt <tilman@imap.cc> > Cc: Sasha Levin <sasha.levin@oracle.com> > Signed-off-by: Peter Hurley <peter@hurleysoftware.com> > Signed-off-by: Amit Pundir <amit.pundir@linaro.org> > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> > > --- > drivers/tty/tty_ldisc.c | 7 +++++++ > 1 file changed, 7 insertions(+) > > --- a/drivers/tty/tty_ldisc.c > +++ b/drivers/tty/tty_ldisc.c > @@ -414,6 +414,10 @@ EXPORT_SYMBOL_GPL(tty_ldisc_flush); > * they are not on hot paths so a little discipline won't do > * any harm. > * > + * The line discipline-related tty_struct fields are reset to > + * prevent the ldisc driver from re-using stale information for > + * the new ldisc instance. > + * > * Locking: takes termios_rwsem > */ > > @@ -422,6 +426,9 @@ static void tty_set_termios_ldisc(struct > down_write(&tty->termios_rwsem); > tty->termios.c_line = num; > up_write(&tty->termios_rwsem); > + > + tty->disc_data = NULL; > + tty->receive_room = 0; > } > > /** >
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 3.18 00/59] 3.18.55-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 31/59] USB: serial: io_ti: fix div-by-zero in set_termios Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 18/59] USB: serial: ftdi_sio: fix setting latency for unprivileged users Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 52/59] stackprotector: Increase the per-task stack canarys random range from 32 bits to 64 bits on 64-bit platforms Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 44/59] ARM: dts: at91: sama5d3_xplained: fix ADC vref Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 58/59] drivers: char: mem: Check for address space wraparound with mmap() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 27/59] USB: iowarrior: fix info ioctl on big-endian hosts Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 48/59] xc2028: Fix use-after-free bug properly Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 55/59] tracing/kprobes: Enforce kprobes teardown after testing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 20/59] usb: host: xhci-plat: propagate return value of platform_get_irq() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 05/59] dm btree: fix for dm_btree_find_lowest_key() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 40/59] [media] zr364xx: enforce minimum size when reading header Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 24/59] [media] mceusb: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 42/59] [media] cx231xx-audio: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 09/59] mwifiex: pcie: fix cmd_buf use-after-free in remove/reset Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 16/59] iio: dac: ad7303: fix channel description Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 11/59] regulator: tps65023: Fix inverted core enable logic. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 34/59] tty: Prevent ldisc drivers from re-using stale tty fields Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
Re: [PATCH 3.18 34/59] tty: Prevent ldisc drivers from re-using stale tty fields Alan Cox <gnomes@lxorguk.ukuu.org.uk> - 2017-05-24 15:50 +0200
Re: [PATCH 3.18 34/59] tty: Prevent ldisc drivers from re-using stale tty fields Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 17:10 +0200
[PATCH 3.18 46/59] arm64: uaccess: ensure extension of access_ok() addr Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 30/59] USB: serial: mct_u232: fix big-endian baud-rate handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 32/59] USB: hub: fix SS hub-descriptor handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 41/59] [media] cx231xx-cards: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 47/59] arm64: documentation: document tagged pointer stack constraints Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 13/59] cdc-acm: fix possible invalid access when processing notification Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 50/59] metag/uaccess: Fix access_ok() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 54/59] osf_wait4(): fix infoleak Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 49/59] mm/huge_memory.c: respect FOLL_FORCE/FOLL_COW for thp Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 51/59] metag/uaccess: Check access_ok in strncpy_from_user Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 33/59] USB: hub: fix non-SS hub-descriptor handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 45/59] ARM: dts: at91: sama5d3_xplained: not all ADC channels are available Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 28/59] usb: serial: option: add Telit ME910 support Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 15/59] of: fdt: add missing allocation-failure check Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 26/59] usb: musb: tusb6010_omap: Do not reset the other directions packet size Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 23/59] [media] usbvision: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 53/59] uwb: fix device quirk on big-endian hosts Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 56/59] PCI: Fix pci_mmap_fits() for HAVE_PCI_RESOURCE_TO_USER platforms Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 36/59] iio: proximity: as3935: fix as3935_write Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 3.18 17/59] pid_ns: Sleep in TASK_INTERRUPTIBLE in zap_pid_ns_processes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
[PATCH 3.18 06/59] dm bufio: avoid a possible ABBA deadlock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
[PATCH 3.18 19/59] USB: serial: ftdi_sio: add Olimex ARM-USB-TINY(H) PIDs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
[PATCH 3.18 12/59] ath9k_htc: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
[PATCH 3.18 22/59] net: irda: irda-usb: fix firmware name on big-endian hosts Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
[PATCH 3.18 25/59] [media] ttusb2: limit messages to buffer size Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
[PATCH 3.18 14/59] of: fix sparse warning in of_pci_range_parser_one Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
[PATCH 3.18 04/59] USB: core: replace %p with %pK Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
[PATCH 3.18 08/59] dm space map disk: fix some book keeping in the disk space map Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
[PATCH 3.18 07/59] dm thin metadata: call precommit before saving the roots Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
[PATCH 3.18 39/59] [media] dib0700: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
[PATCH 3.18 38/59] [media] s5p-mfc: Fix unbalanced call to clock management Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
[PATCH 3.18 43/59] powerpc/pseries: Fix of_node_put() underflow during DLPAR remove Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
[PATCH 3.18 37/59] [media] gspca: konica: add missing endpoint sanity check Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
[PATCH 3.18 03/59] char: lp: fix possible integer overflow in lp_setup() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
[PATCH 3.18 02/59] watchdog: pcwd_usb: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
[PATCH 3.18 01/59] USB: ene_usb6250: fix DMA to the stack Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
Re: [PATCH 3.18 00/59] 3.18.55-stable review Guenter Roeck <linux@roeck-us.net> - 2017-05-24 17:50 +0200
csiph-web