kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/drivers/tty
History
Peter Hurley 16c30eea95 tty: Prevent ldisc drivers from re-using stale tty fields 
commit dd42bf1197 upstream.

Line discipline drivers may mistakenly misuse ldisc-related fields
when initializing. For example, a failure to initialize tty->receive_room
in the N_GIGASET_M101 line discipline was recently found and fixed [1].
Now, the N_X25 line discipline has been discovered accessing the previous
line discipline's already-freed private data [2].

Harden the ldisc interface against misuse by initializing revelant
tty fields before instancing the new line discipline.

[1]
    commit fd98e9419d
    Author: Tilman Schmidt <tilman@imap.cc>
    Date:   Tue Jul 14 00:37:13 2015 +0200

    isdn/gigaset: reset tty->receive_room when attaching ser_gigaset

[2] Report from Sasha Levin <sasha.levin@oracle.com>
    [  634.336761] ==================================================================
    [  634.338226] BUG: KASAN: use-after-free in x25_asy_open_tty+0x13d/0x490 at addr ffff8800a743efd0
    [  634.339558] Read of size 4 by task syzkaller_execu/8981
    [  634.340359] =============================================================================
    [  634.341598] BUG kmalloc-512 (Not tainted): kasan: bad access detected
    ...
    [  634.405018] Call Trace:
    [  634.405277] dump_stack (lib/dump_stack.c:52)
    [  634.405775] print_trailer (mm/slub.c:655)
    [  634.406361] object_err (mm/slub.c:662)
    [  634.406824] kasan_report_error (mm/kasan/report.c:138 mm/kasan/report.c:236)
    [  634.409581] __asan_report_load4_noabort (mm/kasan/report.c:279)
    [  634.411355] x25_asy_open_tty (drivers/net/wan/x25_asy.c:559 (discriminator 1))
    [  634.413997] tty_ldisc_open.isra.2 (drivers/tty/tty_ldisc.c:447)
    [  634.414549] tty_set_ldisc (drivers/tty/tty_ldisc.c:567)
    [  634.415057] tty_ioctl (drivers/tty/tty_io.c:2646 drivers/tty/tty_io.c:2879)
    [  634.423524] do_vfs_ioctl (fs/ioctl.c:43 fs/ioctl.c:607)
    [  634.427491] SyS_ioctl (fs/ioctl.c:622 fs/ioctl.c:613)
    [  634.427945] entry_SYSCALL_64_fastpath (arch/x86/entry/entry_64.S:188)

Cc: Tilman Schmidt <tilman@imap.cc>
Cc: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2017-02-23 03:54:44 +00:00
..
hvc xen/events: don't bind non-percpu VIRQs with percpu chip 2015-06-02 12:08:17 +01:00
ipwireless tty: Fix low_latency BUG 2014-02-28 16:31:00 -08:00
serial serial: 8250: added acces i/o products quad and octal serial cards 2016-11-20 01:17:20 +00:00
vt vt: clear selection before resizing 2017-02-23 03:54:22 +00:00
amiserial.c tty/amiserial: avoid interruptible_sleep_on 2014-01-07 17:05:21 -08:00
bfin_jtag_comm.c TTY: bfin_jtag_comm: fix incorrect placement of __initdata tag 2013-09-30 19:09:37 -07:00
cyclades.c tty: an overflow of multiplication in drivers/tty/cyclades.c 2013-12-20 12:21:57 -08:00
ehv_bytechan.c drivers: clean-up prom.h implicit includes 2013-10-09 20:04:04 -05:00
goldfish.c goldfish: clean up the checkpatch warnings 2014-05-15 13:20:42 -07:00
isicom.c TTY: switch tty_flip_buffer_push 2013-01-15 22:30:15 -08:00
Kconfig drivers/tty: ehv_bytechan fails to build as a module 2014-01-09 17:52:12 -06:00
Makefile tty: Add timed, writer-prioritized rw semaphore 2013-05-20 12:30:32 -07:00
metag_da.c tree-wide: use reinit_completion instead of INIT_COMPLETION 2013-11-15 09:32:21 +09:00
moxa.c TTY: add tty_port_tty_hangup helper 2013-03-18 16:24:29 -07:00
moxa.h tty: move a number of tty drivers from drivers/char/ to drivers/tty/ 2011-02-22 16:14:56 -08:00
mxser.c tty: mxser: Fix build warning introduced by dfc7b837c7 (Re: linux-next: build warning after merge of the tty.current tree) 2013-05-22 10:26:02 -07:00
mxser.h Fix common misspellings 2011-03-31 11:26:23 -03:00
n_gsm.c tty/n_gsm.c: fix a memory leak when gsmtty is removed 2015-05-28 10:00:01 +01:00
n_hdlc.c drivers/tty/n_hdlc.c: replace kmalloc/memset by kzalloc 2014-05-28 13:33:18 -07:00
n_r3964.c tty: Always handle NULL flag ptr 2013-12-08 16:56:05 -08:00
n_tracerouter.c n_tracerouter and n_tracesink ldisc additions. 2011-05-13 16:31:00 -07:00
n_tracesink.c n_tracerouter and n_tracesink ldisc additions. 2011-05-13 16:31:00 -07:00
n_tracesink.h n_tracerouter and n_tracesink ldisc additions. 2011-05-13 16:31:00 -07:00
n_tty.c Fix OpenSSH pty regression on close 2016-08-22 22:37:53 +01:00
nozomi.c tty: Remove unnecessary semicolons 2013-10-16 13:08:16 -07:00
pty.c pty: make sure super_block is still valid in final /dev/tty close 2016-02-25 10:34:48 +00:00
rocket.c tty: remove DEFINE_PCI_DEVICE_TABLE macro 2013-12-08 17:09:07 -08:00
rocket.h tty: move a number of tty drivers from drivers/char/ to drivers/tty/ 2011-02-22 16:14:56 -08:00
rocket_int.h tty: move a number of tty drivers from drivers/char/ to drivers/tty/ 2011-02-22 16:14:56 -08:00
synclink.c synclink: fix info leak in ioctl 2014-03-17 16:13:23 -07:00
synclink_gt.c tty: synclink: avoid sleep_on race 2014-01-07 17:05:21 -08:00
synclinkmp.c synclink: fix info leak in ioctl 2014-03-17 16:13:23 -07:00
sysrq.c sysrq: Fix warning in sysrq generated crash. 2016-02-02 19:39:38 +00:00
tty_audit.c audit: anchor all pid references in the initial pid namespace 2014-03-20 10:11:55 -04:00
tty_buffer.c tty: Fix GPF in flush_to_ldisc() 2016-01-25 10:43:37 +00:00
tty_io.c tty: Fix unsafe ldisc reference via ioctl(TIOCGETD) 2016-02-16 10:55:25 +00:00
tty_ioctl.c TTY: fix tty_wait_until_sent on 64-bit machines 2015-03-18 15:07:29 +00:00
tty_ldisc.c tty: Prevent ldisc drivers from re-using stale tty fields 2017-02-23 03:54:44 +00:00
tty_ldsem.c lockdep: Make held_lock->check and "int check" argument bool 2014-02-09 21:18:54 +01:00
tty_mutex.c tty: tty_mutex.c: Fixed coding style warning (using printk) 2012-10-24 11:34:51 -07:00
tty_port.c tty: delete non-required instances of include <linux/init.h> 2014-01-07 17:05:21 -08:00