enable vfio-vga

[pve-kernel-3.10.0.git] / n_tty-Fix-n_tty_write-crash-when-echoing-in-raw-mode.patch

From: Peter Hurley <peter@hurleysoftware.com>\r
\r
commit 4291086b1f081b869c6d79e5b7441633dc3ace00 upstream.\r
\r
The tty atomic_write_lock does not provide an exclusion guarantee for\r
the tty driver if the termios settings are LECHO & !OPOST.  And since\r
it is unexpected and not allowed to call TTY buffer helpers like\r
tty_insert_flip_string concurrently, this may lead to crashes when\r
concurrect writers call pty_write. In that case the following two\r
writers:\r
* the ECHOing from a workqueue and\r
* pty_write from the process\r
race and can overflow the corresponding TTY buffer like follows.\r
\r
If we look into tty_insert_flip_string_fixed_flag, there is:\r
  int space = __tty_buffer_request_room(port, goal, flags);\r
  struct tty_buffer *tb = port->buf.tail;\r
  ...\r
  memcpy(char_buf_ptr(tb, tb->used), chars, space);\r
  ...\r
  tb->used += space;\r
\r
so the race of the two can result in something like this:\r
              A                                B\r
__tty_buffer_request_room\r
                                  __tty_buffer_request_room\r
memcpy(buf(tb->used), ...)\r
tb->used += space;\r
                                  memcpy(buf(tb->used), ...) ->BOOM\r
\r
B's memcpy is past the tty_buffer due to the previous A's tb->used\r
increment.\r
\r
Since the N_TTY line discipline input processing can output\r
concurrently with a tty write, obtain the N_TTY ldisc output_lock to\r
serialize echo output with normal tty writes.  This ensures the tty\r
buffer helper tty_insert_flip_string is not called concurrently and\r
everything is fine.\r
\r
Note that this is nicely reproducible by an ordinary user using\r
forkpty and some setup around that (raw termios + ECHO). And it is\r
present in kernels at least after commit\r
d945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to\r
use the normal buffering logic) in 2.6.31-rc3.\r
\r
js: add more info to the commit log\r
js: switch to bool\r
js: lock unconditionally\r
js: lock only the tty->ops->write call\r
\r
References: CVE-2014-0196\r
Reported-and-tested-by: Jiri Slaby <jslaby@suse.cz>\r
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>\r
Signed-off-by: Jiri Slaby <jslaby@suse.cz>\r
Cc: Linus Torvalds <torvalds@linux-foundation.org>\r
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>\r
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\r
\r
---\r
 drivers/tty/n_tty.c |    4 ++++\r
 1 file changed, 4 insertions(+)\r
\r
--- a/drivers/tty/n_tty.c\r
+++ b/drivers/tty/n_tty.c\r
@@ -2066,8 +2066,12 @@ static ssize_t n_tty_write(struct tty_st\r
 			if (tty->ops->flush_chars)\r
 				tty->ops->flush_chars(tty);\r
 		} else {\r
+			struct n_tty_data *ldata = tty->disc_data;\r
+\r
 			while (nr > 0) {\r
+				mutex_lock(&ldata->output_lock);\r
 				c = tty->ops->write(tty, b, nr);\r
+				mutex_unlock(&ldata->output_lock);\r
 				if (c < 0) {\r
 					retval = c;\r
 					goto break_out;\r
\r