Peter Hurley
f52aa97a9b
UPSTREAM: tty: Prevent ldisc drivers from re-using stale tty fields
(cherry picked from commit dd42bf1197)
Line discipline drivers may mistakenly misuse ldisc-related fields
when initializing. For example, a failure to initialize tty->receive_room
in the N_GIGASET_M101 line discipline was recently found and fixed [1].
Now, the N_X25 line discipline has been discovered accessing the previous
line discipline's already-freed private data [2].
Harden the ldisc interface against misuse by initializing revelant
tty fields before instancing the new line discipline.
[1]
commit fd98e9419d
Author: Tilman Schmidt <tilman@imap.cc>
Date: Tue Jul 14 00:37:13 2015 +0200
isdn/gigaset: reset tty->receive_room when attaching ser_gigaset
[2] Report from Sasha Levin <sasha.levin@oracle.com>
[ 634.336761] ==================================================================
[ 634.338226] BUG: KASAN: use-after-free in x25_asy_open_tty+0x13d/0x490 at addr ffff8800a743efd0
[ 634.339558] Read of size 4 by task syzkaller_execu/8981
[ 634.340359] =============================================================================
[ 634.341598] BUG kmalloc-512 (Not tainted): kasan: bad access detected
...
[ 634.405018] Call Trace:
[ 634.405277] dump_stack (lib/dump_stack.c:52)
[ 634.405775] print_trailer (mm/slub.c:655)
[ 634.406361] object_err (mm/slub.c:662)
[ 634.406824] kasan_report_error (mm/kasan/report.c:138 mm/kasan/report.c:236)
[ 634.409581] __asan_report_load4_noabort (mm/kasan/report.c:279)
[ 634.411355] x25_asy_open_tty (drivers/net/wan/x25_asy.c:559 (discriminator 1))
[ 634.413997] tty_ldisc_open.isra.2 (drivers/tty/tty_ldisc.c:447)
[ 634.414549] tty_set_ldisc (drivers/tty/tty_ldisc.c:567)
[ 634.415057] tty_ioctl (drivers/tty/tty_io.c:2646 drivers/tty/tty_io.c:2879)
[ 634.423524] do_vfs_ioctl (fs/ioctl.c:43 fs/ioctl.c:607)
[ 634.427491] SyS_ioctl (fs/ioctl.c:622 fs/ioctl.c:613)
[ 634.427945] entry_SYSCALL_64_fastpath (arch/x86/entry/entry_64.S:188)
Cc: Tilman Schmidt <tilman@imap.cc>
Cc: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change-Id: Ibed6feadfb9706d478f93feec3b240aecfc64af3
Bug: 30951112
2016-09-14 14:44:29 +05:30
..
2016-06-01 12:15:50 -07:00
2016-03-14 15:32:21 +08:00
2016-08-10 11:49:29 +02:00
2016-07-29 21:38:37 +01:00
2016-08-10 11:49:24 +02:00
2016-05-11 11:21:10 +02:00
2016-06-01 12:15:50 -07:00
2016-05-04 14:48:54 -07:00
2016-08-18 12:33:31 +08:00
2016-08-10 11:49:28 +02:00
2016-03-03 15:07:15 -08:00
2016-01-04 21:46:45 -05:00
2016-05-19 12:35:13 +05:30
2016-06-14 17:08:03 +08:00
2016-07-27 09:47:40 -07:00
2016-08-10 11:49:25 +02:00
2016-02-16 13:53:25 -08:00
2016-07-27 09:47:27 -07:00
2016-05-04 14:48:54 -07:00
2015-11-11 10:21:34 -08:00
2016-07-29 18:59:49 +02:00
2015-11-24 15:25:46 -08:00
2016-07-27 09:47:29 -07:00
2016-08-27 11:27:14 +08:00
2016-08-18 12:33:31 +08:00
2015-10-30 16:10:40 +01:00
2016-03-03 15:07:16 -08:00
2016-07-27 09:47:37 -07:00
2016-02-25 12:01:23 -08:00
2016-08-11 12:15:51 +08:00
2016-08-16 09:30:48 +02:00
2015-11-06 17:50:42 -08:00
2016-04-12 09:09:05 -07:00
2016-07-27 09:47:37 -07:00
2016-07-27 09:47:27 -07:00
2016-08-11 12:15:55 +08:00
2016-07-27 09:47:32 -07:00
2016-06-01 12:15:49 -07:00
2015-12-15 13:24:21 -05:00
2015-11-05 13:15:12 -08:00
2015-12-29 08:28:32 -07:00
2015-10-15 20:31:59 +11:00
2015-11-04 14:03:04 +05:30
2016-06-01 12:15:53 -07:00
2016-09-14 14:26:20 +05:30
2016-09-14 14:26:32 +05:30
2016-07-27 09:47:35 -07:00
2015-11-12 07:06:18 -05:00
2016-06-07 18:14:34 -07:00
2016-08-18 18:56:03 +05:30
2016-09-14 14:43:34 +05:30
2016-07-29 21:38:37 +01:00
2016-08-18 18:56:03 +05:30
2015-11-10 18:11:41 -08:00
2015-11-08 16:24:43 -05:00
2016-04-20 15:41:54 +09:00
2015-12-22 10:12:04 -07:00
2016-05-11 11:21:21 +02:00
2016-07-29 21:38:37 +01:00
2015-12-12 16:07:25 +01:00
2016-06-07 18:14:35 -07:00
2016-04-20 15:42:09 +09:00
2015-11-04 14:47:13 -08:00
2016-03-03 15:07:28 -08:00
2016-08-10 11:49:27 +02:00
2016-08-11 12:15:55 +08:00
2016-08-16 09:30:48 +02:00
2016-08-11 12:15:55 +08:00
2015-12-12 02:31:11 +01:00
2016-08-10 11:49:25 +02:00
2016-05-04 14:48:47 -07:00
2016-05-18 17:06:51 -07:00
2015-11-26 17:44:28 +02:00
2016-05-12 09:27:18 +08:00
2016-08-10 11:49:28 +02:00
2016-09-14 14:43:34 +05:30
2016-03-09 15:34:49 -08:00
2016-05-11 11:21:11 +02:00
2016-08-10 11:49:28 +02:00
2015-11-04 22:15:15 -08:00
2015-10-28 21:05:21 +02:00
2016-08-18 12:33:31 +08:00
2016-04-12 09:09:02 -07:00
2016-07-27 09:47:29 -07:00
2016-06-01 12:15:53 -07:00
2016-09-14 14:44:29 +05:30
2016-08-18 18:56:03 +05:30
2015-11-04 21:50:37 -08:00
2016-03-09 15:34:50 -08:00
2015-12-07 17:28:10 +02:00
2016-05-12 09:27:18 +08:00
2016-07-27 09:47:34 -07:00
2015-11-04 22:15:15 -08:00
2016-02-16 13:54:18 -08:00
2016-04-12 09:08:54 -07:00
2016-08-10 11:49:26 +02:00
2016-05-19 12:32:41 +05:30
2016-05-19 12:32:41 +05:30