linux-kernel - Re: [PATCH] vt: defer kfree() of vc_screenbuf in vc_do

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <0c9d8003-ba3f-8f2d-7c5a-56c5ca7db750@i-love.sakura.ne.jp>
Date:   Tue, 4 Aug 2020 20:15:43 +0900
From:   Tetsuo Handa <penguin-kernel@...ove.sakura.ne.jp>
To:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Jiri Slaby <jslaby@...e.com>,
        Daniel Vetter <daniel.vetter@...ll.ch>,
        Bartlomiej Zolnierkiewicz <b.zolnierkie@...sung.com>
Cc:     dri-devel@...ts.freedesktop.org, linux-fbdev@...r.kernel.org,
        linux-kernel@...r.kernel.org,
        syzbot <syzbot+9116ecc1978ca3a12f43@...kaller.appspotmail.com>
Subject: Re: [PATCH] vt: defer kfree() of vc_screenbuf in vc_do_resize()

Do you think this approach is acceptable? Or, do we need to modify set_origin() ?

On 2020/07/29 23:57, Tetsuo Handa wrote:
> syzbot is reporting UAF bug in set_origin() from vc_do_resize() [1], for
> vc_do_resize() calls kfree(vc->vc_screenbuf) before calling set_origin().
> 
> Unfortunately, in set_origin(), vc->vc_sw->con_set_origin() might access
> vc->vc_pos when scroll is involved in order to manipulate cursor, but
> vc->vc_pos refers already released vc->vc_screenbuf until vc->vc_pos gets
> updated based on the result of vc->vc_sw->con_set_origin().
> 
> Preserving old buffer and tolerating outdated vc members until set_origin()
> completes would be easier than preventing vc->vc_sw->con_set_origin() from
> accessing outdated vc members.
> 
> [1] https://syzkaller.appspot.com/bug?id=6649da2081e2ebdc65c0642c214b27fe91099db3
> 
> Reported-by: syzbot <syzbot+9116ecc1978ca3a12f43@...kaller.appspotmail.com>
> Signed-off-by: Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
> ---
>  drivers/tty/vt/vt.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
> index 42d8c67..c9ee8e9 100644
> --- a/drivers/tty/vt/vt.c
> +++ b/drivers/tty/vt/vt.c
> @@ -1196,7 +1196,7 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc,
>  	unsigned int old_rows, old_row_size, first_copied_row;
>  	unsigned int new_cols, new_rows, new_row_size, new_screen_size;
>  	unsigned int user;
> -	unsigned short *newscreen;
> +	unsigned short *oldscreen, *newscreen;
>  	struct uni_screen *new_uniscr = NULL;
>  
>  	WARN_CONSOLE_UNLOCKED();
> @@ -1294,10 +1294,11 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc,
>  	if (new_scr_end > new_origin)
>  		scr_memsetw((void *)new_origin, vc->vc_video_erase_char,
>  			    new_scr_end - new_origin);
> -	kfree(vc->vc_screenbuf);
> +	oldscreen = vc->vc_screenbuf;
>  	vc->vc_screenbuf = newscreen;
>  	vc->vc_screenbuf_size = new_screen_size;
>  	set_origin(vc);
> +	kfree(oldscreen);
>  
>  	/* do part of a reset_terminal() */
>  	vc->vc_top = 0;
>