linux-kernel - [PATCH v2] tty: vt: selection: fix soft lockup in paste

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240313094529.679957-1-yiyang13@huawei.com>
Date: Wed, 13 Mar 2024 09:45:29 +0000
From: Yi Yang <yiyang13@...wei.com>
To: <gregkh@...uxfoundation.org>, <jirislaby@...nel.org>
CC: <linux-kernel@...r.kernel.org>, <linux-serial@...r.kernel.org>
Subject: [PATCH v2] tty: vt: selection: fix soft lockup in paste_selection()

Soft lockup occurs when vt device used n_null ldisc, n_null_receivebuf()
is not implemented in null_ldisc. So tty_ldisc_receive_buf always return
0 in paste_selection(), this cause deadloop and cause soft lockup.

This can be reproduced as follows:
  int ldisc = 0x1b; // 0x1b is n_null
  struct{
  	char subcode;
  	struct tiocl_selection sel;
  } data;
  date.subcode = TIOCL_SETSEL;
  data.sel.xs = 0;
  data.sel.xe = 1;
  data.sel.ys = 0;
  data.sel.ye = 1;
  data.sel.sel_mode = TIOCL_SELCHAR;
  char bytes[2] = {TIOCL_PASTESEL, 0};
  open("ttyxx", O_RDWR) // open a vt device
  ioctl(fd, TIOCSETD, &ldisc) // set ldisc to n_null
  ioctl(fd, TIOCLINUX, &data.subcode);
  ioctl(fd, TIOCLINUX, bytes); // cause deadloop

Fix soft lockup by check receive_buf() and receive_buf2() is NULL.

Signed-off-by: Yi Yang <yiyang13@...wei.com>
---

v2:Change Check Condition.

 drivers/tty/vt/selection.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/tty/vt/selection.c b/drivers/tty/vt/selection.c
index 564341f1a74f..715e111376a7 100644
--- a/drivers/tty/vt/selection.c
+++ b/drivers/tty/vt/selection.c
@@ -397,6 +397,12 @@ int paste_selection(struct tty_struct *tty)
 	ld = tty_ldisc_ref_wait(tty);
 	if (!ld)
 		return -EIO;	/* ldisc was hung up */
+
+	/*tty_ldisc_receive_buf() won't do anything and cause deadloop later*/
+	if (!ld->ops->receive_buf && !ld->ops->receive_buf2) {
+		tty_ldisc_deref(ld);
+		return -EIO;
+	}
 	tty_buffer_lock_exclusive(&vc->port);
 
 	add_wait_queue(&vc->paste_wait, &wait);
-- 
2.25.1