WSL2-Linux-Kernel/drivers/tty
Jiri Slaby 07e6124a1a vt: selection, close sel_buffer race
syzkaller reported this UAF:
BUG: KASAN: use-after-free in n_tty_receive_buf_common+0x2481/0x2940 drivers/tty/n_tty.c:1741
Read of size 1 at addr ffff8880089e40e9 by task syz-executor.1/13184

CPU: 0 PID: 13184 Comm: syz-executor.1 Not tainted 5.4.7 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Call Trace:
...
 kasan_report+0xe/0x20 mm/kasan/common.c:634
 n_tty_receive_buf_common+0x2481/0x2940 drivers/tty/n_tty.c:1741
 tty_ldisc_receive_buf+0xac/0x190 drivers/tty/tty_buffer.c:461
 paste_selection+0x297/0x400 drivers/tty/vt/selection.c:372
 tioclinux+0x20d/0x4e0 drivers/tty/vt/vt.c:3044
 vt_ioctl+0x1bcf/0x28d0 drivers/tty/vt/vt_ioctl.c:364
 tty_ioctl+0x525/0x15a0 drivers/tty/tty_io.c:2657
 vfs_ioctl fs/ioctl.c:47 [inline]

It is due to a race between parallel paste_selection (TIOCL_PASTESEL)
and set_selection_user (TIOCL_SETSEL) invocations. One uses sel_buffer,
while the other frees it and reallocates a new one for another
selection. Add a mutex to close this race.

The mutex takes care properly of sel_buffer and sel_buffer_lth only. The
other selection global variables (like sel_start, sel_end, and sel_cons)
are protected only in set_selection_user. The other functions need quite
some more work to close the races of the variables there. This is going
to happen later.

This likely fixes (I am unsure as there is no reproducer provided) bug
206361 too. It was marked as CVE-2020-8648.

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Reported-by: syzbot+59997e8d5cbdc486e6f6@syzkaller.appspotmail.com
References: https://bugzilla.kernel.org/show_bug.cgi?id=206361
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200210081131.23572-2-jslaby@suse.cz
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-02-13 12:10:07 -08:00
..
hvc TTY/Serial patches for 5.5-rc1 2019-12-03 14:09:14 -08:00
ipwireless tty: add SPDX identifiers to Kconfig and Makefiles 2019-04-04 18:48:43 +02:00
serdev serdev: ttyport: restore client ops on deregistration 2020-02-10 12:26:44 -08:00
serial serial: cpm_uart: call cpm_muram_init before registering console 2020-02-13 12:03:26 -08:00
vt vt: selection, close sel_buffer race 2020-02-13 12:10:07 -08:00
Kconfig tty: Fix Kconfig indentation, continued 2019-11-21 14:38:31 +01:00
Makefile tty: Add NULL TTY driver 2019-04-16 15:21:34 +02:00
amiserial.c Remove every trace of SERIAL_MAGIC 2019-11-13 19:01:14 +08:00
cyclades.c remove ioremap_nocache and devm_ioremap_nocache 2020-01-06 09:45:59 +01:00
ehv_bytechan.c tty: Convert to using %pOFn instead of device_node.name 2018-09-18 16:07:25 +02:00
goldfish.c headers: separate linux/mod_devicetable.h from linux/platform_device.h 2018-07-07 17:52:26 +02:00
isicom.c tty/isicom: remove redundant assignment to variable word_count 2019-09-04 12:43:44 +02:00
mips_ejtag_fdc.c remove ioremap_nocache and devm_ioremap_nocache 2020-01-06 09:45:59 +01:00
moxa.c remove ioremap_nocache and devm_ioremap_nocache 2020-01-06 09:45:59 +01:00
moxa.h tty: moxa: Add support for CMSPAR 2017-11-28 15:32:33 +01:00
mxser.c mxser: switch to ->[sg]et_serial() 2018-10-13 00:50:32 -04:00
mxser.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
n_gsm.c netdev: pass the stuck queue to the timeout handler 2019-12-12 21:38:57 -08:00
n_hdlc.c tty: n_hdlc: Use flexible-array member and struct_size() helper 2020-01-23 19:22:49 +01:00
n_null.c tty: Remove redundant license text 2017-11-08 13:08:12 +01:00
n_r3964.c tty: Don't block on IO when ldisc change is pending 2018-12-05 12:16:33 +01:00
n_tracerouter.c tty: Remove redundant license text 2017-11-08 13:08:12 +01:00
n_tracesink.c tty: Remove redundant license text 2017-11-08 13:08:12 +01:00
n_tracesink.h tty: Remove redundant license text 2017-11-08 13:08:12 +01:00
n_tty.c n_tty: check for negative and zero space return from tty_write_room 2019-04-16 15:21:33 +02:00
nozomi.c tty: nozomi: Use dev_get_drvdata 2019-09-04 12:43:44 +02:00
pty.c Revert "tty: pty: Fix race condition between release_one_tty and pty_write" 2019-03-29 15:47:40 +01:00
rocket.c tty: rocket: reduce stack usage 2019-11-04 17:42:28 +01:00
rocket.h tty: rocket: Remove RCPK_GET_STRUCT ioctl 2019-04-25 11:58:56 +02:00
rocket_int.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
synclink.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next 2020-01-28 16:02:33 -08:00
synclink_gt.c TTY/Serial driver updates for 5.6-rc1 2020-01-29 10:13:27 -08:00
synclinkmp.c TTY/Serial driver updates for 5.6-rc1 2020-01-29 10:13:27 -08:00
sysrq.c proc: convert everything to "struct proc_ops" 2020-02-04 03:05:26 +00:00
tty_audit.c audit: join tty records to their syscall 2019-02-07 21:33:54 -05:00
tty_baudrate.c tty: baudrate: SPARC supports few more baud rates 2020-01-22 10:23:26 +01:00
tty_buffer.c tty: increase the default flip buffer limit to 2*640K 2019-01-30 12:03:58 +01:00
tty_io.c tty: drop useless variable initialisation in tty_kopen() 2019-12-17 14:42:45 +01:00
tty_ioctl.c move compat handling of tty ioctls to tty_compat_ioctl() 2018-09-14 11:12:17 -04:00
tty_jobctrl.c tty: fix read of tty->pgrp outside of ctrl_lock 2019-03-28 01:28:23 +09:00
tty_ldisc.c tty_ldisc: simplify tty_ldisc_autoload initialization 2019-10-04 15:11:25 +02:00
tty_ldsem.c locking/lockdep: Remove unused @nested argument from lock_release() 2019-10-09 12:46:10 +02:00
tty_mutex.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
tty_port.c serdev: ttyport: restore client ops on deregistration 2020-02-10 12:26:44 -08:00
ttynull.c tty: Add NULL TTY driver 2019-04-16 15:21:34 +02:00
vcc.c tty: fix up a few remaining files without SPDX identifiers 2019-04-04 18:48:43 +02:00