|
 |
db33ec |
From 8a9cce994f0c37c1b4dfc313a1b01fb009c55d01 Mon Sep 17 00:00:00 2001
|
|
|
db33ec |
From: Julien Thierry <jthierry@redhat.com>
|
|
|
db33ec |
Date: Thu, 21 Jan 2021 14:41:40 +0100
|
|
|
db33ec |
Subject: [PATCH] [tty] Fix ->pgrp locking in tiocspgrp()
|
|
|
db33ec |
|
|
|
db33ec |
Kernels:
|
|
|
db33ec |
3.10.0-1160.el7
|
|
|
db33ec |
3.10.0-1160.2.1.el7
|
|
|
db33ec |
3.10.0-1160.2.2.el7
|
|
|
db33ec |
3.10.0-1160.6.1.el7
|
|
|
db33ec |
3.10.0-1160.11.1.el7
|
|
|
db33ec |
3.10.0-1160.15.1.el7
|
|
|
db33ec |
|
|
|
db33ec |
Changes since last build:
|
|
|
db33ec |
arches: x86_64 ppc64le
|
|
|
db33ec |
tty_io.o: changed function: tty_ioctl
|
|
|
db33ec |
---------------------------
|
|
|
db33ec |
|
|
|
db33ec |
Modifications:
|
|
|
db33ec |
None
|
|
|
db33ec |
|
|
|
db33ec |
commit ba0ec80fb32a3ca6e15d51ddcb54c1095f04cf2a
|
|
|
db33ec |
Author: Chris von Recklinghausen <crecklin@redhat.com>
|
|
|
db33ec |
Date: Wed Jan 6 19:26:01 2021 -0500
|
|
|
db33ec |
|
|
|
db33ec |
[tty] Fix ->pgrp locking in tiocspgrp()
|
|
|
db33ec |
|
|
|
db33ec |
Message-id: <20210106192601.11675-1-crecklin@redhat.com>
|
|
|
db33ec |
Patchwork-id: 10200
|
|
|
db33ec |
Patchwork-instance: patchwork-private
|
|
|
db33ec |
O-Subject: [kernel team] [RHEL 7.9.Z bz1908193 CVE-2020-29661 PATCH] tty: Fix ->pgrp locking in tiocspgrp()
|
|
|
db33ec |
Bugzilla: 1908193
|
|
|
db33ec |
CVE: CVE-2020-29661
|
|
|
db33ec |
RH-Acked-by: Oleg Nesterov <oleg@redhat.com>
|
|
|
db33ec |
RH-Acked-by: Waiman Long <longman@redhat.com>
|
|
|
db33ec |
|
|
|
db33ec |
From: Jann Horn <jannh@google.com>
|
|
|
db33ec |
|
|
|
db33ec |
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1908193
|
|
|
db33ec |
Brew: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=34103731
|
|
|
db33ec |
CVE: CVE-2020-29661
|
|
|
db33ec |
Upstream Status: linux
|
|
|
db33ec |
Tested: CKI https://beaker.engineering.redhat.com/jobs/?jobsearch-0.table=Whiteboard&jobsearch-0.operation=contains&jobsearch-0.value=cki%40gitlab%3A620704
|
|
|
db33ec |
bug has no reproducer
|
|
|
db33ec |
|
|
|
db33ec |
Conflicts: tiocspgrp is defined in drivers/tty/tty_io.c in rhel7 so make
|
|
|
db33ec |
change there.
|
|
|
db33ec |
drop changes to drivers/tty/tty_jobctrl.c
|
|
|
db33ec |
|
|
|
db33ec |
tiocspgrp() takes two tty_struct pointers: One to the tty that userspace
|
|
|
db33ec |
passed to ioctl() (`tty`) and one to the TTY being changed (`real_tty`).
|
|
|
db33ec |
These pointers are different when ioctl() is called with a master fd.
|
|
|
db33ec |
|
|
|
db33ec |
To properly lock real_tty->pgrp, we must take real_tty->ctrl_lock.
|
|
|
db33ec |
|
|
|
db33ec |
This bug makes it possible for racing ioctl(TIOCSPGRP, ...) calls on
|
|
|
db33ec |
both sides of a PTY pair to corrupt the refcount of `struct pid`,
|
|
|
db33ec |
leading to use-after-free errors.
|
|
|
db33ec |
|
|
|
db33ec |
Fixes: 47f86834bbd4 ("redo locking of tty->pgrp")
|
|
|
db33ec |
CC: stable@kernel.org
|
|
|
db33ec |
Signed-off-by: Jann Horn <jannh@google.com>
|
|
|
db33ec |
Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
|
|
|
db33ec |
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
|
db33ec |
(cherry picked from commit 54ffccbf053b5b6ca4f6e45094b942fab92a25fc)
|
|
|
db33ec |
|
|
|
db33ec |
Conflicts:
|
|
|
db33ec |
drivers/tty/tty_jobctrl.c
|
|
|
db33ec |
Signed-off-by: Chris von Recklinghausen <crecklin@redhat.com>
|
|
|
db33ec |
Signed-off-by: Augusto Caringi <acaringi@redhat.com>
|
|
|
db33ec |
|
|
|
db33ec |
Signed-off-by: Julien Thierry <jthierry@redhat.com>
|
|
|
db33ec |
---
|
|
|
db33ec |
drivers/tty/tty_io.c | 4 ++--
|
|
|
db33ec |
1 file changed, 2 insertions(+), 2 deletions(-)
|
|
|
db33ec |
|
|
|
db33ec |
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
|
|
|
db33ec |
index c6e277aae06..713e1ad5c09 100644
|
|
|
db33ec |
--- a/drivers/tty/tty_io.c
|
|
|
db33ec |
+++ b/drivers/tty/tty_io.c
|
|
|
db33ec |
@@ -2542,10 +2542,10 @@ static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t
|
|
|
db33ec |
if (session_of_pgrp(pgrp) != task_session(current))
|
|
|
db33ec |
goto out_unlock;
|
|
|
db33ec |
retval = 0;
|
|
|
db33ec |
- spin_lock_irqsave(&tty->ctrl_lock, flags);
|
|
|
db33ec |
+ spin_lock_irqsave(&real_tty->ctrl_lock, flags);
|
|
|
db33ec |
put_pid(real_tty->pgrp);
|
|
|
db33ec |
real_tty->pgrp = get_pid(pgrp);
|
|
|
db33ec |
- spin_unlock_irqrestore(&tty->ctrl_lock, flags);
|
|
|
db33ec |
+ spin_unlock_irqrestore(&real_tty->ctrl_lock, flags);
|
|
|
db33ec |
out_unlock:
|
|
|
db33ec |
rcu_read_unlock();
|
|
|
db33ec |
return retval;
|
|
|
db33ec |
--
|
|
|
db33ec |
2.25.4
|
|
|
db33ec |
|