GitHub PushEvent at 2014-05-20 18:55:13
Repository: android_kernel_google_msm
Actor: bruce2728
Payload: {"shas":[["710ed6069cc78142e1b07b4f406074c4dc44d8e0","4b8373d016f277527198385ba72fda0feb5da015@hurleysoftware.com","n_tty: Fix n_tty_write crash when echoing in raw mode\n\nThe tty atomic_write_lock does not provide an exclusion guarantee for\nthe tty driver if the termios settings are LECHO & !OPOST.  And since\nit is unexpected and not allowed to call TTY buffer helpers like\ntty_insert_flip_string concurrently, this may lead to crashes when\nconcurrect writers call pty_write. In that case the following two\nwriters:\n* the ECHOing from a workqueue and\n* pty_write from the process\nrace and can overflow the corresponding TTY buffer like follows.\n\nIf we look into tty_insert_flip_string_fixed_flag, there is:\n  int space = __tty_buffer_request_room(port, goal, flags);\n  struct tty_buffer *tb = port->buf.tail;\n  ...\n  memcpy(char_buf_ptr(tb, tb->used), chars, space);\n  ...\n  tb->used += space;\n\nso the race of the two can result in something like this:\n              A                                B\n__tty_buffer_request_room\n                                  __tty_buffer_request_room\nmemcpy(buf(tb->used), ...)\ntb->used += space;\n                                  memcpy(buf(tb->used), ...) ->BOOM\n\nB's memcpy is past the tty_buffer due to the previous A's tb->used\nincrement.\n\nSince the N_TTY line discipline input processing can output\nconcurrently with a tty write, obtain the N_TTY ldisc output_lock to\nserialize echo output with normal tty writes.  This ensures the tty\nbuffer helper tty_insert_flip_string is not called concurrently and\neverything is fine.\n\nNote that this is nicely reproducible by an ordinary user using\nforkpty and some setup around that (raw termios + ECHO). And it is\npresent in kernels at least after commit\nd945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to\nuse the normal buffering logic) in 2.6.31-rc3.\n\njs: add more info to the commit log\njs: switch to bool\njs: lock unconditionally\njs: lock only the tty->ops->write call\n\nReferences: CVE-2014-0196\nReported-and-tested-by: Jiri Slaby <jslaby@suse.cz>\nSigned-off-by: Peter Hurley <peter@hurleysoftware.com>\nSigned-off-by: Jiri Slaby <jslaby@suse.cz>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Alan Cox <alan@lxorguk.ukuu.org.uk>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n[bwh: Backported to 3.4: output_lock is a member of struct tty_struct]\n\nChange-Id: Iba2e2957a4cb60107ad66d647232ab25823d1e61","Peter Hurley",true],["cb44d7efbe9de568cbe11afa53f7659add85fae7","383cdd1132743df0dea6fcdd4c5cb3f7da3240e0@gmail.com","Merge branch 'cm-11.0' of https://github.com/CyanogenMod/android_kernel_google_msm into cm-11.0\n\nConflicts:\n\tdrivers/tty/n_tty.c","Rob",true]],"size":2,"ref":"refs/heads/cm-11.0","head":"cb44d7efbe9de568cbe11afa53f7659add85fae7"}