WSL2-Linux-Kernel/drivers/tty/vt
Jiri Slaby 07e6124a1a vt: selection, close sel_buffer race
syzkaller reported this UAF:
BUG: KASAN: use-after-free in n_tty_receive_buf_common+0x2481/0x2940 drivers/tty/n_tty.c:1741
Read of size 1 at addr ffff8880089e40e9 by task syz-executor.1/13184

CPU: 0 PID: 13184 Comm: syz-executor.1 Not tainted 5.4.7 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Call Trace:
...
 kasan_report+0xe/0x20 mm/kasan/common.c:634
 n_tty_receive_buf_common+0x2481/0x2940 drivers/tty/n_tty.c:1741
 tty_ldisc_receive_buf+0xac/0x190 drivers/tty/tty_buffer.c:461
 paste_selection+0x297/0x400 drivers/tty/vt/selection.c:372
 tioclinux+0x20d/0x4e0 drivers/tty/vt/vt.c:3044
 vt_ioctl+0x1bcf/0x28d0 drivers/tty/vt/vt_ioctl.c:364
 tty_ioctl+0x525/0x15a0 drivers/tty/tty_io.c:2657
 vfs_ioctl fs/ioctl.c:47 [inline]

It is due to a race between parallel paste_selection (TIOCL_PASTESEL)
and set_selection_user (TIOCL_SETSEL) invocations. One uses sel_buffer,
while the other frees it and reallocates a new one for another
selection. Add a mutex to close this race.

The mutex takes care properly of sel_buffer and sel_buffer_lth only. The
other selection global variables (like sel_start, sel_end, and sel_cons)
are protected only in set_selection_user. The other functions need quite
some more work to close the races of the variables there. This is going
to happen later.

This likely fixes (I am unsure as there is no reproducer provided) bug
206361 too. It was marked as CVE-2020-8648.

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Reported-by: syzbot+59997e8d5cbdc486e6f6@syzkaller.appspotmail.com
References: https://bugzilla.kernel.org/show_bug.cgi?id=206361
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200210081131.23572-2-jslaby@suse.cz
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-02-13 12:10:07 -08:00
..
.gitignore tty: vt: move conmakehash to drivers/tty/vt/ from scripts/ 2019-12-17 14:42:46 +01:00
Makefile kbuild: rename hostprogs-y/always to hostprogs/always-y 2020-02-04 01:53:07 +09:00
conmakehash.c tty: vt: move conmakehash to drivers/tty/vt/ from scripts/ 2019-12-17 14:42:46 +01:00
consolemap.c tty/vt: avoid high order pages allocation on GIO_UNIMAP ioctl 2019-04-16 15:21:34 +02:00
cp437.uni tty: fix up a few remaining files without SPDX identifiers 2019-04-04 18:48:43 +02:00
defkeymap.c_shipped tty: fix up a few remaining files without SPDX identifiers 2019-04-04 18:48:43 +02:00
defkeymap.map tty: fix up a few remaining files without SPDX identifiers 2019-04-04 18:48:43 +02:00
keyboard.c tty: vt: keyboard: reject invalid keycodes 2019-11-23 18:31:07 +01:00
selection.c vt: selection, close sel_buffer race 2020-02-13 12:10:07 -08:00
vc_screen.c vcs: prevent write access to vcsu devices 2019-11-27 07:47:17 +01:00
vt.c vt: fix scrollback flushing on background consoles 2020-02-10 13:51:44 -08:00
vt_ioctl.c vt: vt_ioctl: fix race in VT_RESIZEX 2020-02-12 11:53:23 -08:00