linux-kernel - Re: [PATCH v3] bluetooth: Fix WARNING in tty_set

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Sun, 3 Feb 2019 12:36:32 -0700
From:   shuah <shuah@...nel.org>
To:     Marcel Holtmann <marcel@...tmann.org>
Cc:     Johan Hedberg <johan.hedberg@...il.com>, johan@...nel.org,
        viro@...iv.linux.org.uk, linux-bluetooth@...r.kernel.org,
        linux-kernel@...r.kernel.org, shuah <shuah@...nel.org>
Subject: Re: [PATCH v3] bluetooth: Fix WARNING in tty_set_termios()

On 2/3/19 10:31 AM, Marcel Holtmann wrote:
> Hi Shuah,
> 
>> tty_set_termios() has the following WARN_ON which can be triggered with a
>> syscall to invoke TIOCSETD __NR_ioctl.
>>
>> WARN_ON(tty->driver->type == TTY_DRIVER_TYPE_PTY &&
>>                 tty->driver->subtype == PTY_TYPE_MASTER);
>> Reference: https://syzkaller.appspot.com/bug?id=2410d22f1d8e5984217329dd0884b01d99e3e48d
>>
>> Johan Hovold said: "The problemm started with
>> commit 7721383f4199 ("Bluetooth: hci_uart: Support
>> operational speed during setup") which introduced a new way for how
>> tty_set_termios() could end up being called for a master pty."
>>
>> Fix it by by preventing setting the HCI line discipline for PTYs in
>> hci_uart_tty_open(). Looked into keying off of tty and ldisc ops, and
>> couldn't find any that would be conclusive. Checking tty as such clearly
>> tags the reason for rejecting the request to set ldisc.
>>
>> Reported-by: syzbot+a950165cbb86bdd023a4@...kaller.appspotmail.com
>> Cc: Johan Hovold <johan@...nel.org>
>> Cc: Marcel Holtmann <marcel@...tmann.org>
>> Cc: Al Viro <viro@...iv.linux.org.uk>
>> Signed-off-by: Shuah Khan <shuah@...nel.org>
>> ---
>> drivers/bluetooth/hci_ldisc.c | 5 +++++
>> 1 file changed, 5 insertions(+)
>>
>> diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
>> index fbf7b4df23ab..a3d313fcc0f2 100644
>> --- a/drivers/bluetooth/hci_ldisc.c
>> +++ b/drivers/bluetooth/hci_ldisc.c
>> @@ -480,6 +480,11 @@ static int hci_uart_tty_open(struct tty_struct *tty)
>> 	if (tty->ops->write == NULL)
>> 		return -EOPNOTSUPP;
>>
>> +	/* don't set HCI line discipline on PTYs */
>> +	if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
>> +	    tty->driver->subtype == PTY_TYPE_MASTER)
>> +		return -EINVAL;
>> +
> 
> this is turning in circles. What is wrong with checking !tty->ops->set_termios here?

Yeah. I looked into set_termios and thought that it is set in this path.
My bad. okay v4 is on its way. Sorry it took so long to get on the same
page with you. :(

thanks,
-- Shuah