Skip to content

Commit ebbc3de

Browse files
PlaidCatPlaidCat
committed
vt: vt_ioctl: fix race in VT_RESIZEX
jira LE-1907 cve CVE-2020-36558 Rebuild_History Non-Buildable kernel-3.10.0-1160.118.1.el7 commit-author Eric Dumazet <edumazet@google.com> commit 6cd1ed5 Empty-Commit: Cherry-Pick Conflicts during history rebuild. Will be included in final tarball splat. Ref for failed cherry-pick at: ciq/ciq_backports/kernel-3.10.0-1160.118.1.el7/6cd1ed50.failed We need to make sure vc_cons[i].d is not NULL after grabbing console_lock(), or risk a crash. general protection fault, probably for non-canonical address 0xdffffc0000000068: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000340-0x0000000000000347] CPU: 1 PID: 19462 Comm: syz-executor.5 Not tainted 5.5.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:vt_ioctl+0x1f96/0x26d0 drivers/tty/vt/vt_ioctl.c:883 Code: 74 41 e8 bd a6 84 fd 48 89 d8 48 c1 e8 03 42 80 3c 28 00 0f 85 e4 04 00 00 48 8b 03 48 8d b8 40 03 00 00 48 89 fa 48 c1 ea 03 <42> 0f b6 14 2a 84 d2 74 09 80 fa 03 0f 8e b1 05 00 00 44 89 b8 40 RSP: 0018:ffffc900086d7bb0 EFLAGS: 00010202 RAX: 0000000000000000 RBX: ffffffff8c34ee88 RCX: ffffc9001415c000 RDX: 0000000000000068 RSI: ffffffff83f0e6e3 RDI: 0000000000000340 RBP: ffffc900086d7cd0 R08: ffff888054ce0100 R09: fffffbfff16a2f6d R10: ffff888054ce0998 R11: ffff888054ce0100 R12: 000000000000001d R13: dffffc0000000000 R14: 1ffff920010daf79 R15: 000000000000ff7f FS: 00007f7d13c12700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffd477e3c38 CR3: 0000000095d0a000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: tty_ioctl+0xa37/0x14f0 drivers/tty/tty_io.c:2660 vfs_ioctl fs/ioctl.c:47 [inline] ksys_ioctl+0x123/0x180 fs/ioctl.c:763 __do_sys_ioctl fs/ioctl.c:772 [inline] __se_sys_ioctl fs/ioctl.c:770 [inline] __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:770 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x45b399 Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f7d13c11c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f7d13c126d4 RCX: 000000000045b399 RDX: 0000000020000080 RSI: 000000000000560a RDI: 0000000000000003 RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff R13: 0000000000000666 R14: 00000000004c7f04 R15: 000000000075bf2c Modules linked in: ---[ end trace 80970faf7a67eb77 ]--- RIP: 0010:vt_ioctl+0x1f96/0x26d0 drivers/tty/vt/vt_ioctl.c:883 Code: 74 41 e8 bd a6 84 fd 48 89 d8 48 c1 e8 03 42 80 3c 28 00 0f 85 e4 04 00 00 48 8b 03 48 8d b8 40 03 00 00 48 89 fa 48 c1 ea 03 <42> 0f b6 14 2a 84 d2 74 09 80 fa 03 0f 8e b1 05 00 00 44 89 b8 40 RSP: 0018:ffffc900086d7bb0 EFLAGS: 00010202 RAX: 0000000000000000 RBX: ffffffff8c34ee88 RCX: ffffc9001415c000 RDX: 0000000000000068 RSI: ffffffff83f0e6e3 RDI: 0000000000000340 RBP: ffffc900086d7cd0 R08: ffff888054ce0100 R09: fffffbfff16a2f6d R10: ffff888054ce0998 R11: ffff888054ce0100 R12: 000000000000001d R13: dffffc0000000000 R14: 1ffff920010daf79 R15: 000000000000ff7f FS: 00007f7d13c12700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffd477e3c38 CR3: 0000000095d0a000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Fixes: 1da177e ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: stable <stable@vger.kernel.org> Reported-by: syzbot <syzkaller@googlegroups.com> Link: https://lore.kernel.org/r/20200210190721.200418-1-edumazet@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 6cd1ed5) Signed-off-by: Jonathan Maple <jmaple@ciq.com> # Conflicts: # drivers/tty/vt/vt_ioctl.c
1 parent c48c77e commit ebbc3de

File tree

1 file changed

+175
-0
lines changed

1 file changed

+175
-0
lines changed

‎ciq/ciq_backports/kernel-3.10.0-1160.118.1.el7/6cd1ed50.failed‎

Lines changed: 175 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,175 @@
1+
vt: vt_ioctl: fix race in VT_RESIZEX
2+
3+
jira LE-1907
4+
cve CVE-2020-36558
5+
Rebuild_History Non-Buildable kernel-3.10.0-1160.118.1.el7
6+
commit-author Eric Dumazet <edumazet@google.com>
7+
commit 6cd1ed50efd88261298577cd92a14f2768eddeeb
8+
Empty-Commit: Cherry-Pick Conflicts during history rebuild.
9+
Will be included in final tarball splat. Ref for failed cherry-pick at:
10+
ciq/ciq_backports/kernel-3.10.0-1160.118.1.el7/6cd1ed50.failed
11+
12+
We need to make sure vc_cons[i].d is not NULL after grabbing
13+
console_lock(), or risk a crash.
14+
15+
general protection fault, probably for non-canonical address 0xdffffc0000000068: 0000 [#1] PREEMPT SMP KASAN
16+
KASAN: null-ptr-deref in range [0x0000000000000340-0x0000000000000347]
17+
CPU: 1 PID: 19462 Comm: syz-executor.5 Not tainted 5.5.0-syzkaller #0
18+
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
19+
RIP: 0010:vt_ioctl+0x1f96/0x26d0 drivers/tty/vt/vt_ioctl.c:883
20+
Code: 74 41 e8 bd a6 84 fd 48 89 d8 48 c1 e8 03 42 80 3c 28 00 0f 85 e4 04 00 00 48 8b 03 48 8d b8 40 03 00 00 48 89 fa 48 c1 ea 03 <42> 0f b6 14 2a 84 d2 74 09 80 fa 03 0f 8e b1 05 00 00 44 89 b8 40
21+
RSP: 0018:ffffc900086d7bb0 EFLAGS: 00010202
22+
RAX: 0000000000000000 RBX: ffffffff8c34ee88 RCX: ffffc9001415c000
23+
RDX: 0000000000000068 RSI: ffffffff83f0e6e3 RDI: 0000000000000340
24+
RBP: ffffc900086d7cd0 R08: ffff888054ce0100 R09: fffffbfff16a2f6d
25+
R10: ffff888054ce0998 R11: ffff888054ce0100 R12: 000000000000001d
26+
R13: dffffc0000000000 R14: 1ffff920010daf79 R15: 000000000000ff7f
27+
FS: 00007f7d13c12700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
28+
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
29+
CR2: 00007ffd477e3c38 CR3: 0000000095d0a000 CR4: 00000000001406e0
30+
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
31+
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
32+
Call Trace:
33+
tty_ioctl+0xa37/0x14f0 drivers/tty/tty_io.c:2660
34+
vfs_ioctl fs/ioctl.c:47 [inline]
35+
ksys_ioctl+0x123/0x180 fs/ioctl.c:763
36+
__do_sys_ioctl fs/ioctl.c:772 [inline]
37+
__se_sys_ioctl fs/ioctl.c:770 [inline]
38+
__x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:770
39+
do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294
40+
entry_SYSCALL_64_after_hwframe+0x49/0xbe
41+
RIP: 0033:0x45b399
42+
Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
43+
RSP: 002b:00007f7d13c11c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
44+
RAX: ffffffffffffffda RBX: 00007f7d13c126d4 RCX: 000000000045b399
45+
RDX: 0000000020000080 RSI: 000000000000560a RDI: 0000000000000003
46+
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
47+
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
48+
R13: 0000000000000666 R14: 00000000004c7f04 R15: 000000000075bf2c
49+
Modules linked in:
50+
---[ end trace 80970faf7a67eb77 ]---
51+
RIP: 0010:vt_ioctl+0x1f96/0x26d0 drivers/tty/vt/vt_ioctl.c:883
52+
Code: 74 41 e8 bd a6 84 fd 48 89 d8 48 c1 e8 03 42 80 3c 28 00 0f 85 e4 04 00 00 48 8b 03 48 8d b8 40 03 00 00 48 89 fa 48 c1 ea 03 <42> 0f b6 14 2a 84 d2 74 09 80 fa 03 0f 8e b1 05 00 00 44 89 b8 40
53+
RSP: 0018:ffffc900086d7bb0 EFLAGS: 00010202
54+
RAX: 0000000000000000 RBX: ffffffff8c34ee88 RCX: ffffc9001415c000
55+
RDX: 0000000000000068 RSI: ffffffff83f0e6e3 RDI: 0000000000000340
56+
RBP: ffffc900086d7cd0 R08: ffff888054ce0100 R09: fffffbfff16a2f6d
57+
R10: ffff888054ce0998 R11: ffff888054ce0100 R12: 000000000000001d
58+
R13: dffffc0000000000 R14: 1ffff920010daf79 R15: 000000000000ff7f
59+
FS: 00007f7d13c12700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
60+
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
61+
CR2: 00007ffd477e3c38 CR3: 0000000095d0a000 CR4: 00000000001406e0
62+
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
63+
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
64+
65+
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
66+
Signed-off-by: Eric Dumazet <edumazet@google.com>
67+
Cc: stable <stable@vger.kernel.org>
68+
Reported-by: syzbot <syzkaller@googlegroups.com>
69+
Link: https://lore.kernel.org/r/20200210190721.200418-1-edumazet@google.com
70+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
71+
(cherry picked from commit 6cd1ed50efd88261298577cd92a14f2768eddeeb)
72+
Signed-off-by: Jonathan Maple <jmaple@ciq.com>
73+
74+
# Conflicts:
75+
# drivers/tty/vt/vt_ioctl.c
76+
diff --cc drivers/tty/vt/vt_ioctl.c
77+
index cbff9c0e9b4c,ee6c91ef1f6c..000000000000
78+
--- a/drivers/tty/vt/vt_ioctl.c
79+
+++ b/drivers/tty/vt/vt_ioctl.c
80+
@@@ -869,58 -847,49 +869,72 @@@ int vt_ioctl(struct tty_struct *tty
81+
82+
case VT_RESIZEX:
83+
{
84+
- struct vt_consize v;
85+
+ struct vt_consize __user *vtconsize = up;
86+
+ ushort ll,cc,vlin,clin,vcol,ccol;
87+
if (!perm)
88+
return -EPERM;
89+
- if (copy_from_user(&v, up, sizeof(struct vt_consize)))
90+
- return -EFAULT;
91+
+ if (!access_ok(VERIFY_READ, vtconsize,
92+
+ sizeof(struct vt_consize))) {
93+
+ ret = -EFAULT;
94+
+ break;
95+
+ }
96+
/* FIXME: Should check the copies properly */
97+
- if (!v.v_vlin)
98+
- v.v_vlin = vc->vc_scan_lines;
99+
- if (v.v_clin) {
100+
- int rows = v.v_vlin/v.v_clin;
101+
- if (v.v_rows != rows) {
102+
- if (v.v_rows) /* Parameters don't add up */
103+
- return -EINVAL;
104+
- v.v_rows = rows;
105+
- }
106+
+ __get_user(ll, &vtconsize->v_rows);
107+
+ __get_user(cc, &vtconsize->v_cols);
108+
+ __get_user(vlin, &vtconsize->v_vlin);
109+
+ __get_user(clin, &vtconsize->v_clin);
110+
+ __get_user(vcol, &vtconsize->v_vcol);
111+
+ __get_user(ccol, &vtconsize->v_ccol);
112+
+ vlin = vlin ? vlin : vc->vc_scan_lines;
113+
+ if (clin) {
114+
+ if (ll) {
115+
+ if (ll != vlin/clin) {
116+
+ /* Parameters don't add up */
117+
+ ret = -EINVAL;
118+
+ break;
119+
+ }
120+
+ } else
121+
+ ll = vlin/clin;
122+
}
123+
- if (v.v_vcol && v.v_ccol) {
124+
- int cols = v.v_vcol/v.v_ccol;
125+
- if (v.v_cols != cols) {
126+
- if (v.v_cols)
127+
- return -EINVAL;
128+
- v.v_cols = cols;
129+
- }
130+
+ if (vcol && ccol) {
131+
+ if (cc) {
132+
+ if (cc != vcol/ccol) {
133+
+ ret = -EINVAL;
134+
+ break;
135+
+ }
136+
+ } else
137+
+ cc = vcol/ccol;
138+
}
139+
140+
- if (v.v_clin > 32)
141+
- return -EINVAL;
142+
-
143+
+ if (clin > 32) {
144+
+ ret = -EINVAL;
145+
+ break;
146+
+ }
147+
+
148+
for (i = 0; i < MAX_NR_CONSOLES; i++) {
149+
+ struct vc_data *vcp;
150+
+
151+
if (!vc_cons[i].d)
152+
continue;
153+
console_lock();
154+
++<<<<<<< HEAD
155+
+ if (vlin)
156+
+ vc_cons[i].d->vc_scan_lines = vlin;
157+
+ if (clin)
158+
+ vc_cons[i].d->vc_font.height = clin;
159+
+ vc_cons[i].d->vc_resize_user = 1;
160+
+ vc_resize(vc_cons[i].d, cc, ll);
161+
++=======
162+
+ vcp = vc_cons[i].d;
163+
+ if (vcp) {
164+
+ if (v.v_vlin)
165+
+ vcp->vc_scan_lines = v.v_vlin;
166+
+ if (v.v_clin)
167+
+ vcp->vc_font.height = v.v_clin;
168+
+ vcp->vc_resize_user = 1;
169+
+ vc_resize(vcp, v.v_cols, v.v_rows);
170+
+ }
171+
++>>>>>>> 6cd1ed50efd8 (vt: vt_ioctl: fix race in VT_RESIZEX)
172+
console_unlock();
173+
}
174+
break;
175+
* Unmerged path drivers/tty/vt/vt_ioctl.c

0 commit comments

Comments
 (0)