linux-kernel - [PATCH 5.10/5.15 1/1] tty: add the option to have a tty reject a new ldisc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20240920070809.1145963-2-Ilia.Gavrilov@infotecs.ru>
Date: Fri, 20 Sep 2024 07:08:10 +0000
From: Gavrilov Ilia <Ilia.Gavrilov@...otecs.ru>
To: "stable@...r.kernel.org" <stable@...r.kernel.org>, Greg Kroah-Hartman
	<gregkh@...uxfoundation.org>
CC: Jiri Slaby <jirislaby@...nel.org>, Nicolas Pitre <nico@...xnic.net>,
	"Sasha Levin" <sashal@...nel.org>, "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>, "lvc-project@...uxtesting.org"
	<lvc-project@...uxtesting.org>, Tetsuo Handa
	<penguin-kernel@...ove.sakura.ne.jp>, Andrew Morton
	<akpm@...ux-foundation.org>, Daniel Starke <daniel.starke@...mens.com>,
	syzbot <syzbot+dbac96d8e73b61aa559c@...kaller.appspotmail.com>, "Linus
 Torvalds" <torvalds@...ux-foundation.org>
Subject: [PATCH 5.10/5.15 1/1] tty: add the option to have a tty reject a new
 ldisc

From: Linus Torvalds <torvalds@...ux-foundation.org>

commit 6bd23e0c2bb6c65d4f5754d1456bc9a4427fc59b upstream.

... and use it to limit the virtual terminals to just N_TTY.  They are
kind of special, and in particular, the "con_write()" routine violates
the "writes cannot sleep" rule that some ldiscs rely on.

This avoids the

   BUG: sleeping function called from invalid context at kernel/printk/printk.c:2659

when N_GSM has been attached to a virtual console, and gsmld_write()
calls con_write() while holding a spinlock, and con_write() then tries
to get the console lock.

Tested-by: Tetsuo Handa <penguin-kernel@...ove.sakura.ne.jp>
Cc: Jiri Slaby <jirislaby@...nel.org>
Cc: Andrew Morton <akpm@...ux-foundation.org>
Cc: Daniel Starke <daniel.starke@...mens.com>
Reported-by: syzbot <syzbot+dbac96d8e73b61aa559c@...kaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=dbac96d8e73b61aa559c
Signed-off-by: Linus Torvalds <torvalds@...ux-foundation.org>
Link: https://lore.kernel.org/r/20240423163339.59780-1-torvalds@linux-foundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
[Ilia: In order to adapt this patch to branches 5.10 and 5.15,
the ldisc_ok() function description has been corrected in the old style.]
Signed-off-by: Gavrilov Ilia <Ilia.Gavrilov@...otecs.ru>
---
 drivers/tty/tty_ldisc.c    |  6 ++++++
 drivers/tty/vt/vt.c        | 10 ++++++++++
 include/linux/tty_driver.h |  8 ++++++++
 3 files changed, 24 insertions(+)

diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c
index c23938b8628d..dc5267ac9923 100644
--- a/drivers/tty/tty_ldisc.c
+++ b/drivers/tty/tty_ldisc.c
@@ -579,6 +579,12 @@ int tty_set_ldisc(struct tty_struct *tty, int disc)
 		goto out;
 	}
 
+	if (tty->ops->ldisc_ok) {
+		retval = tty->ops->ldisc_ok(tty, disc);
+		if (retval)
+			goto out;
+	}
+
 	old_ldisc = tty->ldisc;
 
 	/* Shutdown the old discipline. */
diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
index a070f2e7d960..d16b7bdbd442 100644
--- a/drivers/tty/vt/vt.c
+++ b/drivers/tty/vt/vt.c
@@ -3448,6 +3448,15 @@ static void con_cleanup(struct tty_struct *tty)
 	tty_port_put(&vc->port);
 }
 
+/*
+ * We can't deal with anything but the N_TTY ldisc,
+ * because we can sleep in our write() routine.
+ */
+static int con_ldisc_ok(struct tty_struct *tty, int ldisc)
+{
+	return ldisc == N_TTY ? 0 : -EINVAL;
+}
+
 static int default_color           = 7; /* white */
 static int default_italic_color    = 2; // green (ASCII)
 static int default_underline_color = 3; // cyan (ASCII)
@@ -3576,6 +3585,7 @@ static const struct tty_operations con_ops = {
 	.resize = vt_resize,
 	.shutdown = con_shutdown,
 	.cleanup = con_cleanup,
+	.ldisc_ok = con_ldisc_ok,
 };
 
 static struct cdev vc0_cdev;
diff --git a/include/linux/tty_driver.h b/include/linux/tty_driver.h
index 2f719b471d52..315e475e6a09 100644
--- a/include/linux/tty_driver.h
+++ b/include/linux/tty_driver.h
@@ -123,6 +123,13 @@
  *	Optional: Called under the termios lock
  *
  *
+ * int (*ldisc_ok)(struct tty_struct *tty, int ldisc);
+ *
+ *	This routine allows the tty driver to decide if it can deal
+ *	with a particular ldisc.
+ *
+ *	Optional. Called under the tty->ldisc_sem and tty->termios_rwsem.
+ *
  * void (*set_ldisc)(struct tty_struct *tty);
  *
  * 	This routine allows the tty driver to be notified when the
@@ -270,6 +277,7 @@ struct tty_operations {
 	void (*hangup)(struct tty_struct *tty);
 	int (*break_ctl)(struct tty_struct *tty, int state);
 	void (*flush_buffer)(struct tty_struct *tty);
+	int (*ldisc_ok)(struct tty_struct *tty, int ldisc);
 	void (*set_ldisc)(struct tty_struct *tty);
 	void (*wait_until_sent)(struct tty_struct *tty, int timeout);
 	void (*send_xchar)(struct tty_struct *tty, char ch);
-- 
2.39.2