kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-16 22:39:48 +00:00
Code Issues Releases Packages Activity
linux/drivers/tty
History
Alexander Potapenko 7d3cf2631f vt: prevent leaking uninitialized data to userspace via /dev/vcs* 
commit 21eff69aaa upstream.

KMSAN reported an infoleak when reading from /dev/vcs*:

  BUG: KMSAN: kernel-infoleak in vcs_read+0x18ba/0x1cc0
  Call Trace:
  ...
   kmsan_copy_to_user+0x7a/0x160 mm/kmsan/kmsan.c:1253
   copy_to_user ./include/linux/uaccess.h:184
   vcs_read+0x18ba/0x1cc0 drivers/tty/vt/vc_screen.c:352
   __vfs_read+0x1b2/0x9d0 fs/read_write.c:416
   vfs_read+0x36c/0x6b0 fs/read_write.c:452
  ...
  Uninit was created at:
   kmsan_save_stack_with_flags mm/kmsan/kmsan.c:279
   kmsan_internal_poison_shadow+0xb8/0x1b0 mm/kmsan/kmsan.c:189
   kmsan_kmalloc+0x94/0x100 mm/kmsan/kmsan.c:315
   __kmalloc+0x13a/0x350 mm/slub.c:3818
   kmalloc ./include/linux/slab.h:517
   vc_allocate+0x438/0x800 drivers/tty/vt/vt.c:787
   con_install+0x8c/0x640 drivers/tty/vt/vt.c:2880
   tty_driver_install_tty drivers/tty/tty_io.c:1224
   tty_init_dev+0x1b5/0x1020 drivers/tty/tty_io.c:1324
   tty_open_by_driver drivers/tty/tty_io.c:1959
   tty_open+0x17b4/0x2ed0 drivers/tty/tty_io.c:2007
   chrdev_open+0xc25/0xd90 fs/char_dev.c:417
   do_dentry_open+0xccc/0x1440 fs/open.c:794
   vfs_open+0x1b6/0x2f0 fs/open.c:908
  ...
  Bytes 0-79 of 240 are uninitialized

Consistently allocating |vc_screenbuf| with kzalloc() fixes the problem

Reported-by: syzbot+17a8efdf800000@syzkaller.appspotmail.com
Signed-off-by: Alexander Potapenko <glider@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2018-11-20 18:05:31 +00:00
..
hvc xen/events: don't bind non-percpu VIRQs with percpu chip 2015-06-02 12:08:17 +01:00
ipwireless tty: Fix low_latency BUG 2014-02-28 16:31:00 -08:00
serial tty: pl011: Avoid spuriously stuck-off interrupts 2018-11-20 18:04:54 +00:00
vt vt: prevent leaking uninitialized data to userspace via /dev/vcs* 2018-11-20 18:05:31 +00:00
amiserial.c tty/amiserial: avoid interruptible_sleep_on 2014-01-07 17:05:21 -08:00
bfin_jtag_comm.c TTY: bfin_jtag_comm: fix incorrect placement of __initdata tag 2013-09-30 19:09:37 -07:00
cyclades.c tty: an overflow of multiplication in drivers/tty/cyclades.c 2013-12-20 12:21:57 -08:00
ehv_bytechan.c drivers: clean-up prom.h implicit includes 2013-10-09 20:04:04 -05:00
goldfish.c goldfish: clean up the checkpatch warnings 2014-05-15 13:20:42 -07:00
isicom.c tty/isicom: fix big-endian compile warning 2017-11-11 13:33:48 +00:00
Kconfig drivers/tty: ehv_bytechan fails to build as a module 2014-01-09 17:52:12 -06:00
Makefile tty: handle the case where we cannot restore a line discipline 2018-10-21 08:45:38 +01:00
metag_da.c tree-wide: use reinit_completion instead of INIT_COMPLETION 2013-11-15 09:32:21 +09:00
moxa.c TTY: add tty_port_tty_hangup helper 2013-03-18 16:24:29 -07:00
moxa.h tty: move a number of tty drivers from drivers/char/ to drivers/tty/ 2011-02-22 16:14:56 -08:00
mxser.c tty: mxser: Fix build warning introduced by dfc7b837c7 (Re: linux-next: build warning after merge of the tty.current tree) 2013-05-22 10:26:02 -07:00
mxser.h Fix common misspellings 2011-03-31 11:26:23 -03:00
n_gsm.c tty/n_gsm.c: fix a memory leak when gsmtty is removed 2015-05-28 10:00:01 +01:00
n_hdlc.c tty: n_hdlc: get rid of racy n_hdlc.tbuf 2017-03-16 02:27:27 +00:00
n_null.c tty: handle the case where we cannot restore a line discipline 2018-10-21 08:45:38 +01:00
n_r3964.c tty: Always handle NULL flag ptr 2013-12-08 16:56:05 -08:00
n_tracerouter.c n_tracerouter and n_tracesink ldisc additions. 2011-05-13 16:31:00 -07:00
n_tracesink.c n_tracerouter and n_tracesink ldisc additions. 2011-05-13 16:31:00 -07:00
n_tracesink.h n_tracerouter and n_tracesink ldisc additions. 2011-05-13 16:31:00 -07:00
n_tty.c n_tty: Access echo_* variables carefully. 2018-11-20 18:05:30 +00:00
nozomi.c tty: nozomi: avoid a harmless gcc warning 2017-11-11 13:33:47 +00:00
pty.c drivers: tty: Fix use-after-free in pty_common_install 2018-10-21 08:45:37 +01:00
rocket.c tty: remove DEFINE_PCI_DEVICE_TABLE macro 2013-12-08 17:09:07 -08:00
rocket.h tty: move a number of tty drivers from drivers/char/ to drivers/tty/ 2011-02-22 16:14:56 -08:00
rocket_int.h tty: move a number of tty drivers from drivers/char/ to drivers/tty/ 2011-02-22 16:14:56 -08:00
synclink.c synclink: fix info leak in ioctl 2014-03-17 16:13:23 -07:00
synclink_gt.c tty: synclink: avoid sleep_on race 2014-01-07 17:05:21 -08:00
synclinkmp.c synclink: fix info leak in ioctl 2014-03-17 16:13:23 -07:00
sysrq.c sysrq: attach sysrq handler correctly for 32-bit kernel 2017-03-16 02:26:56 +00:00
tty_audit.c audit: anchor all pid references in the initial pid namespace 2014-03-20 10:11:55 -04:00
tty_buffer.c tty: Fix GPF in flush_to_ldisc() 2016-01-25 10:43:37 +00:00
tty_io.c tty: Don't call panic() at tty_ldisc_init() 2018-10-21 08:45:38 +01:00
tty_ioctl.c TTY: fix tty_wait_until_sent on 64-bit machines 2015-03-18 15:07:29 +00:00
tty_ldisc.c tty: Use __GFP_NOFAIL for tty_ldisc_get() 2018-10-21 08:45:44 +01:00
tty_ldsem.c lockdep: Make held_lock->check and "int check" argument bool 2014-02-09 21:18:54 +01:00
tty_mutex.c tty: tty_mutex.c: Fixed coding style warning (using printk) 2012-10-24 11:34:51 -07:00
tty_port.c tty: delete non-required instances of include <linux/init.h> 2014-01-07 17:05:21 -08:00