From 7ea760a5abfe944055381dcde11ac61dd1b52da5 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 6 May 2014 09:19:49 -0700 Subject: [PATCH] 3.4-stable patches added patches: drivers-tty-hvc-don-t-free-hvc_console_setup-after-init.patch n_tty-fix-n_tty_write-crash-when-echoing-in-raw-mode.patch --- ...-t-free-hvc_console_setup-after-init.patch | 33 ++++++++ ...write-crash-when-echoing-in-raw-mode.patch | 82 +++++++++++++++++++ 2 files changed, 115 insertions(+) create mode 100644 queue-3.4/drivers-tty-hvc-don-t-free-hvc_console_setup-after-init.patch create mode 100644 queue-3.4/n_tty-fix-n_tty_write-crash-when-echoing-in-raw-mode.patch diff --git a/queue-3.4/drivers-tty-hvc-don-t-free-hvc_console_setup-after-init.patch b/queue-3.4/drivers-tty-hvc-don-t-free-hvc_console_setup-after-init.patch new file mode 100644 index 00000000000..26bbe4b84b2 --- /dev/null +++ b/queue-3.4/drivers-tty-hvc-don-t-free-hvc_console_setup-after-init.patch @@ -0,0 +1,33 @@ +From 501fed45b7e8836ee9373f4d31e2d85e3db6103a Mon Sep 17 00:00:00 2001 +From: Tomoki Sekiyama +Date: Fri, 2 May 2014 18:58:24 -0400 +Subject: drivers/tty/hvc: don't free hvc_console_setup after init + +From: Tomoki Sekiyama + +commit 501fed45b7e8836ee9373f4d31e2d85e3db6103a upstream. + +When 'console=hvc0' is specified to the kernel parameter in x86 KVM guest, +hvc console is setup within a kthread. However, that will cause SEGV +and the boot will fail when the driver is builtin to the kernel, +because currently hvc_console_setup() is annotated with '__init'. This +patch removes '__init' to boot the guest successfully with 'console=hvc0'. + +Signed-off-by: Tomoki Sekiyama +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/hvc/hvc_console.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/tty/hvc/hvc_console.c ++++ b/drivers/tty/hvc/hvc_console.c +@@ -190,7 +190,7 @@ static struct tty_driver *hvc_console_de + return hvc_driver; + } + +-static int __init hvc_console_setup(struct console *co, char *options) ++static int hvc_console_setup(struct console *co, char *options) + { + if (co->index < 0 || co->index >= MAX_NR_HVC_CONSOLES) + return -ENODEV; diff --git a/queue-3.4/n_tty-fix-n_tty_write-crash-when-echoing-in-raw-mode.patch b/queue-3.4/n_tty-fix-n_tty_write-crash-when-echoing-in-raw-mode.patch new file mode 100644 index 00000000000..179bd0214e5 --- /dev/null +++ b/queue-3.4/n_tty-fix-n_tty_write-crash-when-echoing-in-raw-mode.patch @@ -0,0 +1,82 @@ +From 4291086b1f081b869c6d79e5b7441633dc3ace00 Mon Sep 17 00:00:00 2001 +From: Peter Hurley +Date: Sat, 3 May 2014 14:04:59 +0200 +Subject: n_tty: Fix n_tty_write crash when echoing in raw mode + +From: Peter Hurley + +commit 4291086b1f081b869c6d79e5b7441633dc3ace00 upstream. + +The tty atomic_write_lock does not provide an exclusion guarantee for +the tty driver if the termios settings are LECHO & !OPOST. And since +it is unexpected and not allowed to call TTY buffer helpers like +tty_insert_flip_string concurrently, this may lead to crashes when +concurrect writers call pty_write. In that case the following two +writers: +* the ECHOing from a workqueue and +* pty_write from the process +race and can overflow the corresponding TTY buffer like follows. + +If we look into tty_insert_flip_string_fixed_flag, there is: + int space = __tty_buffer_request_room(port, goal, flags); + struct tty_buffer *tb = port->buf.tail; + ... + memcpy(char_buf_ptr(tb, tb->used), chars, space); + ... + tb->used += space; + +so the race of the two can result in something like this: + A B +__tty_buffer_request_room + __tty_buffer_request_room +memcpy(buf(tb->used), ...) +tb->used += space; + memcpy(buf(tb->used), ...) ->BOOM + +B's memcpy is past the tty_buffer due to the previous A's tb->used +increment. + +Since the N_TTY line discipline input processing can output +concurrently with a tty write, obtain the N_TTY ldisc output_lock to +serialize echo output with normal tty writes. This ensures the tty +buffer helper tty_insert_flip_string is not called concurrently and +everything is fine. + +Note that this is nicely reproducible by an ordinary user using +forkpty and some setup around that (raw termios + ECHO). And it is +present in kernels at least after commit +d945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to +use the normal buffering logic) in 2.6.31-rc3. + +js: add more info to the commit log +js: switch to bool +js: lock unconditionally +js: lock only the tty->ops->write call + +References: CVE-2014-0196 +Reported-and-tested-by: Jiri Slaby +Signed-off-by: Peter Hurley +Signed-off-by: Jiri Slaby +Cc: Linus Torvalds +Cc: Alan Cox +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/n_tty.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/tty/n_tty.c ++++ b/drivers/tty/n_tty.c +@@ -1995,8 +1995,12 @@ static ssize_t n_tty_write(struct tty_st + if (tty->ops->flush_chars) + tty->ops->flush_chars(tty); + } else { ++ struct n_tty_data *ldata = tty->disc_data; ++ + while (nr > 0) { ++ mutex_lock(&ldata->output_lock); + c = tty->ops->write(tty, b, nr); ++ mutex_unlock(&ldata->output_lock); + if (c < 0) { + retval = c; + goto break_out; -- 2.47.3