linux/drivers/tty
Eric Biggers 7cf64b18b0 vt: vt_ioctl: fix use-after-free in vt_in_use()
vt_in_use() dereferences console_driver->ttys[i] without proper locking.
This is broken because the tty can be closed and freed concurrently.

We could fix this by using 'READ_ONCE(console_driver->ttys[i]) != NULL'
and skipping the check of tty_struct::count.  But, looking at
console_driver->ttys[i] isn't really appropriate anyway because even if
it is NULL the tty can still be in the process of being closed.

Instead, fix it by making vt_in_use() require console_lock() and check
whether the vt is allocated and has port refcount > 1.  This works since
following the patch "vt: vt_ioctl: fix VT_DISALLOCATE freeing in-use
virtual console" the port refcount is incremented while the vt is open.

Reproducer (very unreliable, but it worked for me after a few minutes):

	#include <fcntl.h>
	#include <linux/vt.h>

	int main()
	{
		int fd, nproc;
		struct vt_stat state;
		char ttyname[16];

		fd = open("/dev/tty10", O_RDONLY);
		for (nproc = 1; nproc < 8; nproc *= 2)
			fork();
		for (;;) {
			sprintf(ttyname, "/dev/tty%d", rand() % 8);
			close(open(ttyname, O_RDONLY));
			ioctl(fd, VT_GETSTATE, &state);
		}
	}

KASAN report:

	BUG: KASAN: use-after-free in vt_in_use drivers/tty/vt/vt_ioctl.c:48 [inline]
	BUG: KASAN: use-after-free in vt_ioctl+0x1ad3/0x1d70 drivers/tty/vt/vt_ioctl.c:657
	Read of size 4 at addr ffff888065722468 by task syz-vt2/132

	CPU: 0 PID: 132 Comm: syz-vt2 Not tainted 5.6.0-rc5-00130-g089b6d3654916 #13
	Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20191223_100556-anatol 04/01/2014
	Call Trace:
	 [...]
	 vt_in_use drivers/tty/vt/vt_ioctl.c:48 [inline]
	 vt_ioctl+0x1ad3/0x1d70 drivers/tty/vt/vt_ioctl.c:657
	 tty_ioctl+0x9db/0x11b0 drivers/tty/tty_io.c:2660
	 [...]

	Allocated by task 136:
	 [...]
	 kzalloc include/linux/slab.h:669 [inline]
	 alloc_tty_struct+0x96/0x8a0 drivers/tty/tty_io.c:2982
	 tty_init_dev+0x23/0x350 drivers/tty/tty_io.c:1334
	 tty_open_by_driver drivers/tty/tty_io.c:1987 [inline]
	 tty_open+0x3ca/0xb30 drivers/tty/tty_io.c:2035
	 [...]

	Freed by task 41:
	 [...]
	 kfree+0xbf/0x200 mm/slab.c:3757
	 free_tty_struct+0x8d/0xb0 drivers/tty/tty_io.c:177
	 release_one_tty+0x22d/0x2f0 drivers/tty/tty_io.c:1468
	 process_one_work+0x7f1/0x14b0 kernel/workqueue.c:2264
	 worker_thread+0x8b/0xc80 kernel/workqueue.c:2410
	 [...]

Fixes: 4001d7b7fc ("vt: push down the tty lock so we can see what is left to tackle")
Cc: <stable@vger.kernel.org> # v3.4+
Acked-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Link: https://lore.kernel.org/r/20200322034305.210082-3-ebiggers@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-03-27 12:35:04 +01:00
..
hvc tty: hvc: Use the correct style for SPDX License Identifier 2020-03-18 13:01:05 +01:00
ipwireless
serdev serdev: Fix detection of UART devices on Apple machines. 2020-03-06 14:10:44 +01:00
serial tty: serial: make SERIAL_SPRD depend on COMMON_CLK 2020-03-26 15:41:03 +01:00
vt vt: vt_ioctl: fix use-after-free in vt_in_use() 2020-03-27 12:35:04 +01:00
amiserial.c Remove every trace of SERIAL_MAGIC 2019-11-13 19:01:14 +08:00
cyclades.c remove ioremap_nocache and devm_ioremap_nocache 2020-01-06 09:45:59 +01:00
ehv_bytechan.c
goldfish.c
isicom.c tty/isicom: remove redundant assignment to variable word_count 2019-09-04 12:43:44 +02:00
Kconfig tty: Fix Kconfig indentation, continued 2019-11-21 14:38:31 +01:00
Makefile
mips_ejtag_fdc.c tty: mips_ejtag_fdc: Mark expected switch fall-through 2020-03-07 09:52:02 +01:00
moxa.c remove ioremap_nocache and devm_ioremap_nocache 2020-01-06 09:45:59 +01:00
moxa.h
mxser.c
mxser.h
n_gsm.c n_gsm: switch escape to bool 2020-02-19 12:46:48 +01:00
n_hdlc.c tty: n_hdlc, remove FILE and LINE from pr_debug 2020-03-16 08:39:47 +01:00
n_null.c
n_r3964.c
n_tracerouter.c
n_tracesink.c
n_tracesink.h tty: n_tracesink: Use the correct style for SPDX License Identifier 2020-03-18 13:01:31 +01:00
n_tty.c n_tty: Distribute switch variables for initialization 2020-02-23 20:14:50 +01:00
nozomi.c tty: nozomi: Use scnprintf() for avoiding potential buffer overflow 2020-03-18 12:59:29 +01:00
pty.c
rocket_int.h
rocket.c tty: rocket: reduce stack usage 2019-11-04 17:42:28 +01:00
rocket.h
synclink_gt.c TTY/Serial driver updates for 5.6-rc1 2020-01-29 10:13:27 -08:00
synclink.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next 2020-01-28 16:02:33 -08:00
synclinkmp.c TTY/Serial driver updates for 5.6-rc1 2020-01-29 10:13:27 -08:00
sysrq.c sysctl/sysrq: Remove __sysrq_enabled copy 2020-03-07 09:52:02 +01:00
tty_audit.c
tty_baudrate.c tty: baudrate: SPARC supports few more baud rates 2020-01-22 10:23:26 +01:00
tty_buffer.c
tty_io.c tty: fix compat TIOCGSERIAL checking wrong function ptr 2020-03-18 13:15:13 +01:00
tty_ioctl.c
tty_jobctrl.c
tty_ldisc.c tty_ldisc: simplify tty_ldisc_autoload initialization 2019-10-04 15:11:25 +02:00
tty_ldsem.c locking/lockdep: Remove unused @nested argument from lock_release() 2019-10-09 12:46:10 +02:00
tty_mutex.c
tty_port.c serdev: ttyport: restore client ops on deregistration 2020-02-10 12:26:44 -08:00
ttynull.c
vcc.c