linux-kernel - Re: KASAN: user-memory-access Write in n_tty_set

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <35d649ce-0c22-f839-aa4d-19733bf31a9c@I-love.SAKURA.ne.jp>
Date:   Fri, 6 Apr 2018 19:06:47 +0900
From:   Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
To:     gregkh@...uxfoundation.org, jslaby@...e.com
Cc:     syzbot <syzbot+3aa9784721dfb90e984d@...kaller.appspotmail.com>,
        linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Re: KASAN: user-memory-access Write in n_tty_set_termios

On 2018/04/05 19:31, Tetsuo Handa wrote:
> Hello.
> 
> I manually simplified the reproducer. Since the bug is timing dependent,
> this reproducer might fail to reproducer the bug. Anyway, I guess that
> there is a race condition between
> 
> 	vfree(ldata);
> 	tty->disc_data = NULL;
> 
> at n_tty_close() by something (ioctl(TIOCVHANGUP) ?) and
> 
> 	struct n_tty_data *ldata = tty->disc_data;
> 
> 	if (!old || (old->c_lflag ^ tty->termios.c_lflag) & (ICANON | EXTPROC)) {
> 		bitmap_zero(ldata->read_flags, N_TTY_BUF_SIZE);
> 
> at n_tty_set_termios() by ioctl(TCSETS), for the report says that ldata == NULL
> ("Write of size 512 at addr 0000000000001060").

I confirmed that ioctl(TIOCVHANGUP) versus ioctl(TCSETS) can race.
We need some lock for protecting tty->disc_data.

--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -1861,6 +1861,7 @@ static void n_tty_close(struct tty_struct *tty)

        vfree(ldata);
        tty->disc_data = NULL;
+       WARN_ON(1);
 }

 /**

ioctl(TIOCVHANGUP):
[   75.176171] RIP: 0010:n_tty_close+0x34/0x40   /* drivers/tty/n_tty.c:1863 */
[   75.176193] Call Trace:
[   75.176200]  tty_ldisc_kill+0x15/0x30         /* drivers/tty/tty_ldisc.c:641 */
[   75.176204]  tty_ldisc_hangup+0xfa/0x1c0      /* drivers/tty/tty_ldisc.c:758 */
[   75.176209]  __tty_hangup.part.26+0x16b/0x280 /* drivers/tty/tty_io.c:623 */
[   75.176216]  tty_ioctl+0x61f/0x950            /* drivers/tty/tty_io.c:2585 */
[   75.176244]  do_vfs_ioctl+0xa7/0x6d0          /* fs/ioctl.c:686 */
[   75.176257]  ksys_ioctl+0x6b/0x80             /* fs/ioctl.c:701 */
[   75.176266]  SyS_ioctl+0x5/0x10               /* fs/ioctl.c:706 */
[   75.176268]  do_syscall_64+0x6e/0x270         /* arch/x86/entry/common.c:287 */

ioctl(TCSETS):
[   75.783367] BUG: unable to handle kernel paging request at 0000000000001060
[   75.934024] RIP: 0010:n_tty_set_termios+0x17c/0x2a0 /* drivers/tty/n_tty.c:1766 */
[   75.950549] Call Trace:
[   75.952733]  tty_set_termios+0x18a/0x200            /* drivers/tty/tty_ioctl.c:342 */
[   75.954915]  set_termios+0x14a/0x250                /* drivers/tty/tty_ioctl.c:414 */
[   75.956823]  tty_mode_ioctl+0x42e/0x4f0             /* drivers/tty/tty_ioctl.c:749 */
[   75.958632]  tty_ioctl+0x128/0x950                  /* drivers/tty/tty_io.c:2655 */
[   75.968883]  do_vfs_ioctl+0xa7/0x6d0                /* fs/ioctl.c:686 */
[   75.972892]  ksys_ioctl+0x6b/0x80                   /* fs/ioctl.c:701 */
[   75.977031]  SyS_ioctl+0x5/0x10                     /* fs/ioctl.c:706 */
[   75.977036]  do_syscall_64+0x6e/0x270               /* arch/x86/entry/common.c:287 */