GitHub PushEvent at 2014-05-13 17:14:58
Repository: android_kernel_samsung_epicmtd
Actor: cm-gerrit
Payload: {"shas":[["641506bc5652c2f25de6aa981e36518b3bece0da","4b8373d016f277527198385ba72fda0feb5da015@hurleysoftware.com","n_tty: Fix n_tty_write crash when echoing in raw mode\n\nThe tty atomic_write_lock does not provide an exclusion guarantee for\nthe tty driver if the termios settings are LECHO & !OPOST.  And since\nit is unexpected and not allowed to call TTY buffer helpers like\ntty_insert_flip_string concurrently, this may lead to crashes when\nconcurrect writers call pty_write. In that case the following two\nwriters:\n* the ECHOing from a workqueue and\n* pty_write from the process\nrace and can overflow the corresponding TTY buffer like follows.\n\nIf we look into tty_insert_flip_string_fixed_flag, there is:\n  int space = __tty_buffer_request_room(port, goal, flags);\n  struct tty_buffer *tb = port->buf.tail;\n  ...\n  memcpy(char_buf_ptr(tb, tb->used), chars, space);\n  ...\n  tb->used += space;\n\nso the race of the two can result in something like this:\n              A                                B\n__tty_buffer_request_room\n                                  __tty_buffer_request_room\nmemcpy(buf(tb->used), ...)\ntb->used += space;\n                                  memcpy(buf(tb->used), ...) ->BOOM\n\nB's memcpy is past the tty_buffer due to the previous A's tb->used\nincrement.\n\nSince the N_TTY line discipline input processing can output\nconcurrently with a tty write, obtain the N_TTY ldisc output_lock to\nserialize echo output with normal tty writes.  This ensures the tty\nbuffer helper tty_insert_flip_string is not called concurrently and\neverything is fine.\n\nNote that this is nicely reproducible by an ordinary user using\nforkpty and some setup around that (raw termios + ECHO). And it is\npresent in kernels at least after commit\nd945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to\nuse the normal buffering logic) in 2.6.31-rc3.\n\njs: add more info to the commit log\njs: switch to bool\njs: lock unconditionally\njs: lock only the tty->ops->write call\n\nChange-Id: I184a9c6cf9a94c954c182cafd90990dfffafa64e\nReferences: CVE-2014-0196\nReported-and-tested-by: Jiri Slaby <jslaby@suse.cz>\nSigned-off-by: Peter Hurley <peter@hurleysoftware.com>\nSigned-off-by: Jiri Slaby <jslaby@suse.cz>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Alan Cox <alan@lxorguk.ukuu.org.uk>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n[bwh: Backported to 3.2: output_lock is a member of struct tty_struct]\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","Peter Hurley",true]],"size":1,"ref":"refs/heads/cm-11.0","head":"641506bc5652c2f25de6aa981e36518b3bece0da"}