From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, stable@kernel.org,
Jann Horn <jannh@google.com>, Jiri Slaby <jirislaby@kernel.org>
Subject: [PATCH 4.9 31/45] tty: Fix ->session locking
Date: Thu, 10 Dec 2020 15:26:45 +0100 [thread overview]
Message-ID: <20201210142603.889368768@linuxfoundation.org> (raw)
In-Reply-To: <20201210142602.361598591@linuxfoundation.org>
From: Jann Horn <jannh@google.com>
commit c8bcd9c5be24fb9e6132e97da5a35e55a83e36b9 upstream.
Currently, locking of ->session is very inconsistent; most places
protect it using the legacy tty mutex, but disassociate_ctty(),
__do_SAK(), tiocspgrp() and tiocgsid() don't.
Two of the writers hold the ctrl_lock (because they already need it for
->pgrp), but __proc_set_tty() doesn't do that yet.
On a PREEMPT=y system, an unprivileged user can theoretically abuse
this broken locking to read 4 bytes of freed memory via TIOCGSID if
tiocgsid() is preempted long enough at the right point. (Other things
might also go wrong, especially if root-only ioctls are involved; I'm
not sure about that.)
Change the locking on ->session such that:
- tty_lock() is held by all writers: By making disassociate_ctty()
hold it. This should be fine because the same lock can already be
taken through the call to tty_vhangup_session().
The tricky part is that we need to shorten the area covered by
siglock to be able to take tty_lock() without ugly retry logic; as
far as I can tell, this should be fine, since nothing in the
signal_struct is touched in the `if (tty)` branch.
- ctrl_lock is held by all writers: By changing __proc_set_tty() to
hold the lock a little longer.
- All readers that aren't holding tty_lock() hold ctrl_lock: By
adding locking to tiocgsid() and __do_SAK(), and expanding the area
covered by ctrl_lock in tiocspgrp().
Cc: stable@kernel.org
Signed-off-by: Jann Horn <jannh@google.com>
Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/tty_io.c | 51 +++++++++++++++++++++++++++++++++++++--------------
include/linux/tty.h | 4 ++++
2 files changed, 41 insertions(+), 14 deletions(-)
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -544,8 +544,8 @@ static void __proc_set_tty(struct tty_st
put_pid(tty->session);
put_pid(tty->pgrp);
tty->pgrp = get_pid(task_pgrp(current));
- spin_unlock_irqrestore(&tty->ctrl_lock, flags);
tty->session = get_pid(task_session(current));
+ spin_unlock_irqrestore(&tty->ctrl_lock, flags);
if (current->signal->tty) {
tty_debug(tty, "current tty %s not NULL!!\n",
current->signal->tty->name);
@@ -935,21 +935,24 @@ void disassociate_ctty(int on_exit)
spin_lock_irq(¤t->sighand->siglock);
put_pid(current->signal->tty_old_pgrp);
current->signal->tty_old_pgrp = NULL;
-
tty = tty_kref_get(current->signal->tty);
+ spin_unlock_irq(¤t->sighand->siglock);
+
if (tty) {
unsigned long flags;
+
+ tty_lock(tty);
spin_lock_irqsave(&tty->ctrl_lock, flags);
put_pid(tty->session);
put_pid(tty->pgrp);
tty->session = NULL;
tty->pgrp = NULL;
spin_unlock_irqrestore(&tty->ctrl_lock, flags);
+ tty_unlock(tty);
tty_kref_put(tty);
} else
tty_debug_hangup(tty, "no current tty\n");
- spin_unlock_irq(¤t->sighand->siglock);
/* Now clear signal->tty under the lock */
read_lock(&tasklist_lock);
session_clear_tty(task_session(current));
@@ -2628,14 +2631,19 @@ static int tiocspgrp(struct tty_struct *
return -ENOTTY;
if (retval)
return retval;
- if (!current->signal->tty ||
- (current->signal->tty != real_tty) ||
- (real_tty->session != task_session(current)))
- return -ENOTTY;
+
if (get_user(pgrp_nr, p))
return -EFAULT;
if (pgrp_nr < 0)
return -EINVAL;
+
+ spin_lock_irq(&real_tty->ctrl_lock);
+ if (!current->signal->tty ||
+ (current->signal->tty != real_tty) ||
+ (real_tty->session != task_session(current))) {
+ retval = -ENOTTY;
+ goto out_unlock_ctrl;
+ }
rcu_read_lock();
pgrp = find_vpid(pgrp_nr);
retval = -ESRCH;
@@ -2645,12 +2653,12 @@ static int tiocspgrp(struct tty_struct *
if (session_of_pgrp(pgrp) != task_session(current))
goto out_unlock;
retval = 0;
- spin_lock_irq(&real_tty->ctrl_lock);
put_pid(real_tty->pgrp);
real_tty->pgrp = get_pid(pgrp);
- spin_unlock_irq(&real_tty->ctrl_lock);
out_unlock:
rcu_read_unlock();
+out_unlock_ctrl:
+ spin_unlock_irq(&real_tty->ctrl_lock);
return retval;
}
@@ -2662,21 +2670,31 @@ out_unlock:
*
* Obtain the session id of the tty. If there is no session
* return an error.
- *
- * Locking: none. Reference to current->signal->tty is safe.
*/
static int tiocgsid(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
{
+ unsigned long flags;
+ pid_t sid;
+
/*
* (tty == real_tty) is a cheap way of
* testing if the tty is NOT a master pty.
*/
if (tty == real_tty && current->signal->tty != real_tty)
return -ENOTTY;
+
+ spin_lock_irqsave(&real_tty->ctrl_lock, flags);
if (!real_tty->session)
- return -ENOTTY;
- return put_user(pid_vnr(real_tty->session), p);
+ goto err;
+ sid = pid_vnr(real_tty->session);
+ spin_unlock_irqrestore(&real_tty->ctrl_lock, flags);
+
+ return put_user(sid, p);
+
+err:
+ spin_unlock_irqrestore(&real_tty->ctrl_lock, flags);
+ return -ENOTTY;
}
/**
@@ -3094,10 +3112,14 @@ void __do_SAK(struct tty_struct *tty)
struct task_struct *g, *p;
struct pid *session;
int i;
+ unsigned long flags;
if (!tty)
return;
- session = tty->session;
+
+ spin_lock_irqsave(&tty->ctrl_lock, flags);
+ session = get_pid(tty->session);
+ spin_unlock_irqrestore(&tty->ctrl_lock, flags);
tty_ldisc_flush(tty);
@@ -3129,6 +3151,7 @@ void __do_SAK(struct tty_struct *tty)
task_unlock(p);
} while_each_thread(g, p);
read_unlock(&tasklist_lock);
+ put_pid(session);
#endif
}
--- a/include/linux/tty.h
+++ b/include/linux/tty.h
@@ -293,6 +293,10 @@ struct tty_struct {
struct termiox *termiox; /* May be NULL for unsupported */
char name[64];
struct pid *pgrp; /* Protected by ctrl lock */
+ /*
+ * Writes protected by both ctrl lock and legacy mutex, readers must use
+ * at least one of them.
+ */
struct pid *session;
unsigned long flags;
int count;
next prev parent reply other threads:[~2020-12-10 19:11 UTC|newest]
Thread overview: 49+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-12-10 14:26 [PATCH 4.9 00/45] 4.9.248-rc1 review Greg Kroah-Hartman
2020-12-10 14:26 ` [PATCH 4.9 01/45] net/af_iucv: set correct sk_protocol for child sockets Greg Kroah-Hartman
2020-12-10 14:26 ` [PATCH 4.9 02/45] rose: Fix Null pointer dereference in rose_send_frame() Greg Kroah-Hartman
2020-12-10 14:26 ` [PATCH 4.9 03/45] usbnet: ipheth: fix connectivity with iOS 14 Greg Kroah-Hartman
2020-12-10 14:26 ` [PATCH 4.9 04/45] bonding: wait for sysfs kobject destruction before freeing struct slave Greg Kroah-Hartman
2020-12-10 14:26 ` [PATCH 4.9 05/45] netfilter: bridge: reset skb->pkt_type after NF_INET_POST_ROUTING traversal Greg Kroah-Hartman
2020-12-10 14:26 ` [PATCH 4.9 06/45] ibmvnic: Ensure that SCRQ entry reads are correctly ordered Greg Kroah-Hartman
2020-12-10 14:26 ` [PATCH 4.9 07/45] ibmvnic: Fix TX completion error handling Greg Kroah-Hartman
2020-12-10 14:26 ` [PATCH 4.9 08/45] net/x25: prevent a couple of overflows Greg Kroah-Hartman
2020-12-10 14:26 ` [PATCH 4.9 09/45] cxgb3: fix error return code in t3_sge_alloc_qset() Greg Kroah-Hartman
2020-12-10 14:26 ` [PATCH 4.9 10/45] net: pasemi: fix error return code in pasemi_mac_open() Greg Kroah-Hartman
2020-12-10 14:26 ` [PATCH 4.9 11/45] net/mlx5: Fix wrong address reclaim when command interface is down Greg Kroah-Hartman
2020-12-10 14:26 ` [PATCH 4.9 12/45] dt-bindings: net: correct interrupt flags in examples Greg Kroah-Hartman
2020-12-10 14:26 ` [PATCH 4.9 13/45] Input: xpad - support Ardwiino Controllers Greg Kroah-Hartman
2020-12-10 14:26 ` [PATCH 4.9 14/45] Input: i8042 - add ByteSpeed touchpad to noloop table Greg Kroah-Hartman
2020-12-10 14:26 ` [PATCH 4.9 15/45] spi: Fix controller unregister order harder Greg Kroah-Hartman
2020-12-10 14:26 ` [PATCH 4.9 16/45] RDMA/i40iw: Address an mmap handler exploit in i40iw Greg Kroah-Hartman
2020-12-10 14:26 ` [PATCH 4.9 17/45] btrfs: sysfs: init devices outside of the chunk_mutex Greg Kroah-Hartman
2020-12-10 14:26 ` [PATCH 4.9 18/45] pinctrl: baytrail: Replace WARN with dev_info_once when setting direct-irq pin to output Greg Kroah-Hartman
2020-12-10 14:26 ` [PATCH 4.9 19/45] pinctrl: baytrail: Fix pin being driven low for a while on gpiod_get(..., GPIOD_OUT_HIGH) Greg Kroah-Hartman
2020-12-10 14:26 ` [PATCH 4.9 20/45] vlan: consolidate VLAN parsing code and limit max parsing depth Greg Kroah-Hartman
2020-12-10 14:26 ` [PATCH 4.9 21/45] geneve: pull IP header before ECN decapsulation Greg Kroah-Hartman
2020-12-10 14:26 ` [PATCH 4.9 22/45] usb: gadget: f_fs: Use local copy of descriptors for userspace copy Greg Kroah-Hartman
2020-12-10 14:26 ` [PATCH 4.9 23/45] USB: serial: kl5kusb105: fix memleak on open Greg Kroah-Hartman
2020-12-10 14:26 ` [PATCH 4.9 24/45] USB: serial: ch341: add new Product ID for CH341A Greg Kroah-Hartman
2020-12-10 14:26 ` [PATCH 4.9 25/45] USB: serial: ch341: sort device-id entries Greg Kroah-Hartman
2020-12-10 14:26 ` [PATCH 4.9 26/45] USB: serial: option: add Fibocom NL668 variants Greg Kroah-Hartman
2020-12-10 14:26 ` [PATCH 4.9 27/45] USB: serial: option: add support for Thales Cinterion EXS82 Greg Kroah-Hartman
2020-12-10 14:26 ` [PATCH 4.9 28/45] tty: Fix ->pgrp locking in tiocspgrp() Greg Kroah-Hartman
2020-12-10 14:26 ` [PATCH 4.9 29/45] ALSA: hda/realtek - Add new codec supported for ALC897 Greg Kroah-Hartman
2020-12-10 14:26 ` [PATCH 4.9 30/45] ALSA: hda/generic: Add option to enforce preferred_dacs pairs Greg Kroah-Hartman
2020-12-10 14:26 ` Greg Kroah-Hartman [this message]
2020-12-10 14:26 ` [PATCH 4.9 32/45] ftrace: Fix updating FTRACE_FL_TRAMP Greg Kroah-Hartman
2020-12-10 14:26 ` [PATCH 4.9 33/45] cifs: fix potential use-after-free in cifs_echo_request() Greg Kroah-Hartman
2020-12-10 14:26 ` [PATCH 4.9 34/45] i2c: imx: Fix reset of I2SR_IAL flag Greg Kroah-Hartman
2020-12-10 14:26 ` [PATCH 4.9 35/45] i2c: imx: Check for I2SR_IAL after every byte Greg Kroah-Hartman
2020-12-10 14:26 ` [PATCH 4.9 36/45] iommu/amd: Set DTE[IntTabLen] to represent 512 IRTEs Greg Kroah-Hartman
2020-12-10 14:26 ` [PATCH 4.9 37/45] spi: Introduce device-managed SPI controller allocation Greg Kroah-Hartman
2020-12-10 14:26 ` [PATCH 4.9 38/45] spi: bcm-qspi: Fix use-after-free on unbind Greg Kroah-Hartman
2020-12-10 14:26 ` [PATCH 4.9 39/45] spi: bcm2835: " Greg Kroah-Hartman
2020-12-10 14:26 ` [PATCH 4.9 40/45] spi: bcm2835: Release the DMA channel if probe fails after dma_init Greg Kroah-Hartman
2020-12-10 14:26 ` [PATCH 4.9 41/45] tracing: Fix userstacktrace option for instances Greg Kroah-Hartman
2020-12-10 14:26 ` [PATCH 4.9 42/45] gfs2: check for empty rgrp tree in gfs2_ri_update Greg Kroah-Hartman
2020-12-10 14:26 ` [PATCH 4.9 43/45] i2c: qup: Fix error return code in qup_i2c_bam_schedule_desc() Greg Kroah-Hartman
2020-12-10 14:26 ` [PATCH 4.9 44/45] Input: i8042 - fix error return code in i8042_setup_aux() Greg Kroah-Hartman
2020-12-10 14:26 ` [PATCH 4.9 45/45] x86/uprobes: Do not use prefixes.nbytes when looping over prefixes.bytes Greg Kroah-Hartman
2020-12-10 21:23 ` [PATCH 4.9 00/45] 4.9.248-rc1 review Shuah Khan
2020-12-10 23:43 ` Guenter Roeck
2020-12-11 12:03 ` Naresh Kamboju
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201210142603.889368768@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=jannh@google.com \
--cc=jirislaby@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).