From 8a9cce994f0c37c1b4dfc313a1b01fb009c55d01 Mon Sep 17 00:00:00 2001 From: Julien Thierry Date: Thu, 21 Jan 2021 14:41:40 +0100 Subject: [PATCH] [tty] Fix ->pgrp locking in tiocspgrp() Kernels: 3.10.0-1160.el7 3.10.0-1160.2.1.el7 3.10.0-1160.2.2.el7 3.10.0-1160.6.1.el7 3.10.0-1160.11.1.el7 3.10.0-1160.15.1.el7 Changes since last build: arches: x86_64 ppc64le tty_io.o: changed function: tty_ioctl --------------------------- Modifications: None commit ba0ec80fb32a3ca6e15d51ddcb54c1095f04cf2a Author: Chris von Recklinghausen Date: Wed Jan 6 19:26:01 2021 -0500 [tty] Fix ->pgrp locking in tiocspgrp() Message-id: <20210106192601.11675-1-crecklin@redhat.com> Patchwork-id: 10200 Patchwork-instance: patchwork-private O-Subject: [kernel team] [RHEL 7.9.Z bz1908193 CVE-2020-29661 PATCH] tty: Fix ->pgrp locking in tiocspgrp() Bugzilla: 1908193 CVE: CVE-2020-29661 RH-Acked-by: Oleg Nesterov RH-Acked-by: Waiman Long From: Jann Horn Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1908193 Brew: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=34103731 CVE: CVE-2020-29661 Upstream Status: linux Tested: CKI https://beaker.engineering.redhat.com/jobs/?jobsearch-0.table=Whiteboard&jobsearch-0.operation=contains&jobsearch-0.value=cki%40gitlab%3A620704 bug has no reproducer Conflicts: tiocspgrp is defined in drivers/tty/tty_io.c in rhel7 so make change there. drop changes to drivers/tty/tty_jobctrl.c tiocspgrp() takes two tty_struct pointers: One to the tty that userspace passed to ioctl() (`tty`) and one to the TTY being changed (`real_tty`). These pointers are different when ioctl() is called with a master fd. To properly lock real_tty->pgrp, we must take real_tty->ctrl_lock. This bug makes it possible for racing ioctl(TIOCSPGRP, ...) calls on both sides of a PTY pair to corrupt the refcount of `struct pid`, leading to use-after-free errors. Fixes: 47f86834bbd4 ("redo locking of tty->pgrp") CC: stable@kernel.org Signed-off-by: Jann Horn Reviewed-by: Jiri Slaby Signed-off-by: Greg Kroah-Hartman (cherry picked from commit 54ffccbf053b5b6ca4f6e45094b942fab92a25fc) Conflicts: drivers/tty/tty_jobctrl.c Signed-off-by: Chris von Recklinghausen Signed-off-by: Augusto Caringi Signed-off-by: Julien Thierry --- drivers/tty/tty_io.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c index c6e277aae06..713e1ad5c09 100644 --- a/drivers/tty/tty_io.c +++ b/drivers/tty/tty_io.c @@ -2542,10 +2542,10 @@ static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t if (session_of_pgrp(pgrp) != task_session(current)) goto out_unlock; retval = 0; - spin_lock_irqsave(&tty->ctrl_lock, flags); + spin_lock_irqsave(&real_tty->ctrl_lock, flags); put_pid(real_tty->pgrp); real_tty->pgrp = get_pid(pgrp); - spin_unlock_irqrestore(&tty->ctrl_lock, flags); + spin_unlock_irqrestore(&real_tty->ctrl_lock, flags); out_unlock: rcu_read_unlock(); return retval; -- 2.25.4