-From: Peter Hurley <peter@hurleysoftware.com>\r
-\r
-commit 4291086b1f081b869c6d79e5b7441633dc3ace00 upstream.\r
-\r
-The tty atomic_write_lock does not provide an exclusion guarantee for\r
-the tty driver if the termios settings are LECHO & !OPOST. And since\r
-it is unexpected and not allowed to call TTY buffer helpers like\r
-tty_insert_flip_string concurrently, this may lead to crashes when\r
-concurrect writers call pty_write. In that case the following two\r
-writers:\r
-* the ECHOing from a workqueue and\r
-* pty_write from the process\r
-race and can overflow the corresponding TTY buffer like follows.\r
-\r
-If we look into tty_insert_flip_string_fixed_flag, there is:\r
- int space = __tty_buffer_request_room(port, goal, flags);\r
- struct tty_buffer *tb = port->buf.tail;\r
- ...\r
- memcpy(char_buf_ptr(tb, tb->used), chars, space);\r
- ...\r
- tb->used += space;\r
-\r
-so the race of the two can result in something like this:\r
- A B\r
-__tty_buffer_request_room\r
- __tty_buffer_request_room\r
-memcpy(buf(tb->used), ...)\r
-tb->used += space;\r
- memcpy(buf(tb->used), ...) ->BOOM\r
-\r
-B's memcpy is past the tty_buffer due to the previous A's tb->used\r
-increment.\r
-\r
-Since the N_TTY line discipline input processing can output\r
-concurrently with a tty write, obtain the N_TTY ldisc output_lock to\r
-serialize echo output with normal tty writes. This ensures the tty\r
-buffer helper tty_insert_flip_string is not called concurrently and\r
-everything is fine.\r
-\r
-Note that this is nicely reproducible by an ordinary user using\r
-forkpty and some setup around that (raw termios + ECHO). And it is\r
-present in kernels at least after commit\r
-d945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to\r
-use the normal buffering logic) in 2.6.31-rc3.\r
-\r
-js: add more info to the commit log\r
-js: switch to bool\r
-js: lock unconditionally\r
-js: lock only the tty->ops->write call\r
-\r
-References: CVE-2014-0196\r
-Reported-and-tested-by: Jiri Slaby <jslaby@suse.cz>\r
-Signed-off-by: Peter Hurley <peter@hurleysoftware.com>\r
-Signed-off-by: Jiri Slaby <jslaby@suse.cz>\r
-Cc: Linus Torvalds <torvalds@linux-foundation.org>\r
-Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>\r
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\r
-\r
----\r
- drivers/tty/n_tty.c | 4 ++++\r
- 1 file changed, 4 insertions(+)\r
-\r
---- a/drivers/tty/n_tty.c\r
-+++ b/drivers/tty/n_tty.c\r
-@@ -2066,8 +2066,12 @@ static ssize_t n_tty_write(struct tty_st\r
- if (tty->ops->flush_chars)\r
- tty->ops->flush_chars(tty);\r
- } else {\r
-+ struct n_tty_data *ldata = tty->disc_data;\r
-+\r
- while (nr > 0) {\r
-+ mutex_lock(&ldata->output_lock);\r
- c = tty->ops->write(tty, b, nr);\r
-+ mutex_unlock(&ldata->output_lock);\r
- if (c < 0) {\r
- retval = c;\r
- goto break_out;\r
-\r