tty: wipe buffer if not echoing data

BugLink: https://bugs.launchpad.net/bugs/1836968
commit b97b3d9fb57860a60592859e332de7759fd54c2e upstream.

If we are not echoing the data to userspace or the console is in icanon
mode, then perhaps it is a "secret" so we should wipe it once we are
done with it.

This mirrors the logic that the audit code has.

Reported-by: aszlig <aszlig@nix.build>
Tested-by: Milan Broz <gmazyland@gmail.com>
Tested-by: Daniel Zatovic <daniel.zatovic@gmail.com>
Tested-by: aszlig <aszlig@nix.build>
Cc: Willy Tarreau <w@1wt.eu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>

diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index 9805ac137d0c619fc84b049963ffd132e8b2cb66..cf12905457c66d881e189ae387554e6f77f7f373 100644 (file)
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -152,17 +152,28 @@ static inline unsigned char *echo_buf_addr(struct n_tty_data *ldata, size_t i)
        return &ldata->echo_buf[i & (N_TTY_BUF_SIZE - 1)];
 }
 
+/* If we are not echoing the data, perhaps this is a secret so erase it */
+static void zero_buffer(struct tty_struct *tty, u8 *buffer, int size)
+{
+       bool icanon = !!L_ICANON(tty);
+       bool no_echo = !L_ECHO(tty);
+
+       if (icanon && no_echo)
+               memset(buffer, 0x00, size);
+}
+
 static int tty_copy_to_user(struct tty_struct *tty, void __user *to,
                            size_t tail, size_t n)
 {
        struct n_tty_data *ldata = tty->disc_data;
        size_t size = N_TTY_BUF_SIZE - tail;
-       const void *from = read_buf_addr(ldata, tail);
+       void *from = read_buf_addr(ldata, tail);
        int uncopied;
 
        if (n > size) {
                tty_audit_add_data(tty, from, size);
                uncopied = copy_to_user(to, from, size);
+               zero_buffer(tty, from, size - uncopied);
                if (uncopied)
                        return uncopied;
                to += size;
@@ -171,7 +182,9 @@ static int tty_copy_to_user(struct tty_struct *tty, void __user *to,
        }
 
        tty_audit_add_data(tty, from, n);
-       return copy_to_user(to, from, n);
+       uncopied = copy_to_user(to, from, n);
+       zero_buffer(tty, from, n - uncopied);
+       return uncopied;
 }
 
 /**
@@ -1960,11 +1973,12 @@ static int copy_from_read_buf(struct tty_struct *tty,
        n = min(head - ldata->read_tail, N_TTY_BUF_SIZE - tail);
        n = min(*nr, n);
        if (n) {
-               const unsigned char *from = read_buf_addr(ldata, tail);
+               unsigned char *from = read_buf_addr(ldata, tail);
                retval = copy_to_user(*b, from, n);
                n -= retval;
                is_eof = n == 1 && *from == EOF_CHAR(tty);
                tty_audit_add_data(tty, from, n);
+               zero_buffer(tty, from, n);
                smp_store_release(&ldata->read_tail, ldata->read_tail + n);
                /* Turn single EOF into zero-length read */
                if (L_EXTPROC(tty) && ldata->icanon && is_eof &&