kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-22 19:14:51 +00:00
Code Issues Releases Packages Activity
linux/drivers/tty
History
Longlong Xia bf171b5e86 tty: n_gsm: Fix use-after-free in gsm_cleanup_mux 
commit 9462f4ca56 upstream.

BUG: KASAN: slab-use-after-free in gsm_cleanup_mux+0x77b/0x7b0
drivers/tty/n_gsm.c:3160 [n_gsm]
Read of size 8 at addr ffff88815fe99c00 by task poc/3379
CPU: 0 UID: 0 PID: 3379 Comm: poc Not tainted 6.11.0+ #56
Hardware name: VMware, Inc. VMware Virtual Platform/440BX
Desktop Reference Platform, BIOS 6.00 11/12/2020
Call Trace:
 <TASK>
 gsm_cleanup_mux+0x77b/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm]
 __pfx_gsm_cleanup_mux+0x10/0x10 drivers/tty/n_gsm.c:3124 [n_gsm]
 __pfx_sched_clock_cpu+0x10/0x10 kernel/sched/clock.c:389
 update_load_avg+0x1c1/0x27b0 kernel/sched/fair.c:4500
 __pfx_min_vruntime_cb_rotate+0x10/0x10 kernel/sched/fair.c:846
 __rb_insert_augmented+0x492/0xbf0 lib/rbtree.c:161
 gsmld_ioctl+0x395/0x1450 drivers/tty/n_gsm.c:3408 [n_gsm]
 _raw_spin_lock_irqsave+0x92/0xf0 arch/x86/include/asm/atomic.h:107
 __pfx_gsmld_ioctl+0x10/0x10 drivers/tty/n_gsm.c:3822 [n_gsm]
 ktime_get+0x5e/0x140 kernel/time/timekeeping.c:195
 ldsem_down_read+0x94/0x4e0 arch/x86/include/asm/atomic64_64.h:79
 __pfx_ldsem_down_read+0x10/0x10 drivers/tty/tty_ldsem.c:338
 __pfx_do_vfs_ioctl+0x10/0x10 fs/ioctl.c:805
 tty_ioctl+0x643/0x1100 drivers/tty/tty_io.c:2818

Allocated by task 65:
 gsm_data_alloc.constprop.0+0x27/0x190 drivers/tty/n_gsm.c:926 [n_gsm]
 gsm_send+0x2c/0x580 drivers/tty/n_gsm.c:819 [n_gsm]
 gsm1_receive+0x547/0xad0 drivers/tty/n_gsm.c:3038 [n_gsm]
 gsmld_receive_buf+0x176/0x280 drivers/tty/n_gsm.c:3609 [n_gsm]
 tty_ldisc_receive_buf+0x101/0x1e0 drivers/tty/tty_buffer.c:391
 tty_port_default_receive_buf+0x61/0xa0 drivers/tty/tty_port.c:39
 flush_to_ldisc+0x1b0/0x750 drivers/tty/tty_buffer.c:445
 process_scheduled_works+0x2b0/0x10d0 kernel/workqueue.c:3229
 worker_thread+0x3dc/0x950 kernel/workqueue.c:3391
 kthread+0x2a3/0x370 kernel/kthread.c:389
 ret_from_fork+0x2d/0x70 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:257

Freed by task 3367:
 kfree+0x126/0x420 mm/slub.c:4580
 gsm_cleanup_mux+0x36c/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm]
 gsmld_ioctl+0x395/0x1450 drivers/tty/n_gsm.c:3408 [n_gsm]
 tty_ioctl+0x643/0x1100 drivers/tty/tty_io.c:2818

[Analysis]
gsm_msg on the tx_ctrl_list or tx_data_list of gsm_mux
can be freed by multi threads through ioctl,which leads
to the occurrence of uaf. Protect it by gsm tx lock.

Signed-off-by: Longlong Xia <xialonglong@kylinos.cn>
Cc: stable <stable@kernel.org>
Suggested-by: Jiri Slaby <jirislaby@kernel.org>
Link: https://lore.kernel.org/r/20240926130213.531959-1-xialonglong@kylinos.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2024-10-22 15:56:50 +02:00
..
hvc hvc/xen: fix event channel handling for secondary consoles 2023-11-28 17:07:08 +00:00
ipwireless tty: drop put_tty_driver 2021-07-27 12:17:21 +02:00
serdev tty: Replace acpi_bus_get_device() 2022-01-31 14:30:06 +01:00
serial tty: rp2: Fix reset with non forgiving PCIe host bridges 2024-10-17 15:21:20 +02:00
vt tty: add the option to have a tty reject a new ldisc 2024-06-27 13:46:17 +02:00
amiserial.c tty: Make ->set_termios() old ktermios const 2022-08-30 14:22:35 +02:00
ehv_bytechan.c tty: drop put_tty_driver 2021-07-27 12:17:21 +02:00
goldfish.c tty: goldfish: Fix free_irq() on remove 2022-06-10 13:31:31 +02:00
Kconfig tty: add rpmsg driver 2021-10-21 12:35:35 +02:00
Makefile tty: add rpmsg driver 2021-10-21 12:35:35 +02:00
mips_ejtag_fdc.c serial: Convert SERIAL_XMIT_SIZE to UART_XMIT_SIZE 2022-06-27 14:41:31 +02:00
moxa.c tty: Make ->set_termios() old ktermios const 2022-08-30 14:22:35 +02:00
mxser.c tty: mxser: remove redundant assignment to hwid 2022-09-01 17:59:36 +02:00
n_gsm.c tty: n_gsm: Fix use-after-free in gsm_cleanup_mux 2024-10-22 15:56:50 +02:00
n_hdlc.c tty: n_hdlc: remove HDLC_MAGIC 2022-09-22 16:12:34 +02:00
n_null.c tty: make tty_ldisc_ops a param in tty_unregister_ldisc 2021-05-13 16:57:16 +02:00
n_tty.c tty: n_tty: Fix buffer offsets when lookahead is used 2024-06-21 14:35:43 +02:00
nozomi.c tty: drop put_tty_driver 2021-07-27 12:17:21 +02:00
pty.c tty: Make ->set_termios() old ktermios const 2022-08-30 14:22:35 +02:00
rpmsg_tty.c tty: rpmsg: Fix race condition releasing tty port 2022-01-26 14:50:26 +01:00
synclink_gt.c tty: synclink_gt: remove MGSL_MAGIC 2022-09-22 16:12:34 +02:00
sysrq.c tty/sysrq: replace smp_processor_id() with get_cpu() 2023-11-28 17:07:08 +00:00
tty.h tty: change tty_write_lock()'s ndelay parameter to bool 2024-01-25 15:27:47 -08:00
tty_audit.c tty: audit: move some local functions out of tty.h 2021-04-15 10:24:58 +02:00
tty_baudrate.c tty: Fix comment style in tty_termios_input_baud_rate() 2022-08-30 14:22:34 +02:00
tty_buffer.c tty: Fix lookahead_buf crash with serdev 2022-08-30 14:31:53 +02:00
tty_io.c usb: cdc-acm: return correct error code on unsupported break 2024-01-25 15:27:47 -08:00
tty_ioctl.c tty: allow TIOCSLCKTRMIOS with CAP_CHECKPOINT_RESTORE 2024-02-05 20:12:58 +00:00
tty_jobctrl.c tty: tty_jobctrl: fix pid memleak in disassociate_ctty() 2023-11-20 11:52:09 +01:00
tty_ldisc.c tty: add the option to have a tty reject a new ldisc 2024-06-27 13:46:17 +02:00
tty_ldsem.c tty/ldsem: Fix syntax errors in comments 2021-12-21 09:15:49 +01:00
tty_mutex.c tty: remove TTY_MAGIC 2022-09-22 16:12:34 +02:00
tty_port.c tty: Implement lookahead to process XON/XOFF timely 2022-06-10 13:51:31 +02:00
ttynull.c tty: drop put_tty_driver 2021-07-27 12:17:21 +02:00
vcc.c tty: vcc: Add check for kstrdup() in vcc_probe() 2023-11-28 17:07:01 +00:00