forge/linux-uconsole
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions
linux-uconsole/drivers
History
Sergei Trofimovich 0fd2df64f1 tty/vt: fix write/write race in ioctl(KDSKBSENT) handler 
commit 46ca3f735f upstream.

The bug manifests as an attempt to access deallocated memory:

    BUG: unable to handle kernel paging request at ffff9c8735448000
    #PF error: [PROT] [WRITE]
    PGD 288a05067 P4D 288a05067 PUD 288a07067 PMD 7f60c2063 PTE 80000007f5448161
    Oops: 0003 [#1] PREEMPT SMP
    CPU: 6 PID: 388 Comm: loadkeys Tainted: G         C        5.0.0-rc6-00153-g5ded5871030e #91
    Hardware name: Gigabyte Technology Co., Ltd. To be filled by O.E.M./H77M-D3H, BIOS F12 11/14/2013
    RIP: 0010:__memmove+0x81/0x1a0
    Code: 4c 89 4f 10 4c 89 47 18 48 8d 7f 20 73 d4 48 83 c2 20 e9 a2 00 00 00 66 90 48 89 d1 4c 8b 5c 16 f8 4c 8d 54 17 f8 48 c1 e9 03 <f3> 48 a5 4d 89 1a e9 0c 01 00 00 0f 1f 40 00 48 89 d1 4c 8b 1e 49
    RSP: 0018:ffffa1b9002d7d08 EFLAGS: 00010203
    RAX: ffff9c873541af43 RBX: ffff9c873541af43 RCX: 00000c6f105cd6bf
    RDX: 0000637882e986b6 RSI: ffff9c8735447ffb RDI: ffff9c8735447ffb
    RBP: ffff9c8739cd3800 R08: ffff9c873b802f00 R09: 00000000fffff73b
    R10: ffffffffb82b35f1 R11: 00505b1b004d5b1b R12: 0000000000000000
    R13: ffff9c873541af3d R14: 000000000000000b R15: 000000000000000c
    FS:  00007f450c390580(0000) GS:ffff9c873f180000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: ffff9c8735448000 CR3: 00000007e213c002 CR4: 00000000000606e0
    Call Trace:
     vt_do_kdgkb_ioctl+0x34d/0x440
     vt_ioctl+0xba3/0x1190
     ? __bpf_prog_run32+0x39/0x60
     ? mem_cgroup_commit_charge+0x7b/0x4e0
     tty_ioctl+0x23f/0x920
     ? preempt_count_sub+0x98/0xe0
     ? __seccomp_filter+0x67/0x600
     do_vfs_ioctl+0xa2/0x6a0
     ? syscall_trace_enter+0x192/0x2d0
     ksys_ioctl+0x3a/0x70
     __x64_sys_ioctl+0x16/0x20
     do_syscall_64+0x54/0xe0
     entry_SYSCALL_64_after_hwframe+0x49/0xbe

The bug manifests on systemd systems with multiple vtcon devices:
  # cat /sys/devices/virtual/vtconsole/vtcon0/name
  (S) dummy device
  # cat /sys/devices/virtual/vtconsole/vtcon1/name
  (M) frame buffer device

There systemd runs 'loadkeys' tool in tapallel for each vtcon
instance. This causes two parallel ioctl(KDSKBSENT) calls to
race into adding the same entry into 'func_table' array at:

    drivers/tty/vt/keyboard.c:vt_do_kdgkb_ioctl()

The function has no locking around writes to 'func_table'.

The simplest reproducer is to have initrams with the following
init on a 8-CPU machine x86_64:

    #!/bin/sh

    loadkeys -q windowkeys ru4 &
    loadkeys -q windowkeys ru4 &
    loadkeys -q windowkeys ru4 &
    loadkeys -q windowkeys ru4 &

    loadkeys -q windowkeys ru4 &
    loadkeys -q windowkeys ru4 &
    loadkeys -q windowkeys ru4 &
    loadkeys -q windowkeys ru4 &
    wait

The change adds lock on write path only. Reads are still racy.

CC: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
CC: Jiri Slaby <jslaby@suse.com>
Link: https://lkml.org/lkml/2019/2/17/256
Signed-off-by: Sergei Trofimovich <slyfox@gentoo.org>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-05-22 07:37:41 +02:00
..
accessibility
acpi ACPI: PM: Set enable_for_wake for wakeup GPEs during suspend-to-idle 2019-05-22 07:37:41 +02:00
amba
android binder: fix handling of misaligned binder object 2019-05-02 09:58:56 +02:00
ata libata: fix using DMA buffers on stack 2019-05-04 09:20:21 +02:00
atm atm: he: fix sign-extension overflow on large shift 2019-02-27 10:08:57 +01:00
auxdisplay auxdisplay: hd44780: Fix memory leak on ->remove() 2019-04-20 09:15:55 +02:00
base x86/speculation/mds: Add sysfs reporting for MDS 2019-05-14 19:17:56 +02:00
bcma
block virtio-blk: limit number of hw queues by nr_cpu_ids 2019-05-10 17:54:09 +02:00
bluetooth Bluetooth: mediatek: fix up an error path to restore bdev->tx_state 2019-05-08 07:21:52 +02:00
bus
cdrom cdrom: Fix race condition in cdrom_sysctl_register 2019-04-05 22:33:10 +02:00
char ipmi: ipmi_si_hardcode.c: init si_type array to fix a crash 2019-05-16 19:41:23 +02:00
clk clk: meson-gxbb: round the vdec dividers to closest 2019-05-10 17:54:06 +02:00
clocksource clocksource/drivers/oxnas: Fix OX820 compatible 2019-05-16 19:41:21 +02:00
connector connector: fix unsafe usage of ->real_parent 2019-03-19 13:12:38 +01:00
cpufreq x86/cpu: Sanitize FAM6_ATOM naming 2019-05-14 19:17:53 +02:00
cpuidle cpuidle: big.LITTLE: fix refcount leak 2019-02-12 19:47:08 +01:00
crypto crypto: ccree - handle tee fips error during power management resume 2019-05-22 07:37:40 +02:00
dax mm/huge_memory: fix vmf_insert_pfn_{pmd, pud}() crash, handle unaligned addresses 2019-05-22 07:37:40 +02:00
dca
devfreq
dio
dma dmaengine: sh: rcar-dmac: Fix glitch in dmaengine_tx_status 2019-05-02 09:58:55 +02:00
dma-buf
edac x86/cpu: Sanitize FAM6_ATOM naming 2019-05-14 19:17:53 +02:00
eisa
extcon
firewire
firmware efi: Fix debugobjects warning on 'efi_rts_work' 2019-05-08 07:21:44 +02:00
fmc
fpga fpga: altera-cvp: fix 'bad IO access' on x86_64 2019-02-12 19:46:59 +01:00
fsi fsi: master-ast-cf: select GENERIC_ALLOCATOR 2018-12-17 09:24:35 +01:00
gnss gnss: sirf: fix premature wakeup interrupt enable 2019-03-10 07:17:21 +01:00
gpio gpio: mxc: add check to return defer probe if clock tree NOT ready 2019-05-08 07:21:53 +02:00
gpu drm/sun4i: Unbind components before releasing DRM and memory 2019-05-16 19:41:25 +02:00
hid HID: input: add mapping for "Toggle Display" key 2019-05-16 19:41:19 +02:00
hsi
hv Drivers: hv: vmbus: Remove the undesired put_cpu_ptr() in hv_synic_cleanup() 2019-05-10 17:54:04 +02:00
hwmon hwmon: (pwm-fan) Disable PWM if fetching cooling data fails 2019-05-16 19:41:18 +02:00
hwspinlock
hwtracing intel_th: pci: Add Comet Lake support 2019-05-10 17:54:10 +02:00
i2c i2c: i2c-stm32f7: Fix SDADEL minimum formula 2019-05-08 07:21:55 +02:00
ide ide: fix a typo in the settings proc file name 2019-01-31 08:14:42 +01:00
idle x86/cpu: Sanitize FAM6_ATOM naming 2019-05-14 19:17:53 +02:00
iio iio: adc: xilinx: prevent touching unclocked h/w on remove 2019-05-16 19:41:19 +02:00
infiniband RDMA/hns: Bugfix for mapping user db 2019-05-16 19:41:25 +02:00
input Input: synaptics-rmi4 - fix possible double free 2019-05-16 19:41:25 +02:00
iommu iommu/amd: Set exclusion range correctly 2019-05-10 17:54:10 +02:00
ipack
irqchip MIPS: perf: ath79: Fix perfcount IRQ assignment 2019-05-16 19:41:24 +02:00
isdn isdn: bas_gigaset: use usb_fill_int_urb() properly 2019-05-16 19:41:31 +02:00
leds leds: trigger: netdev: use memcpy in device_name_store 2019-05-04 09:20:22 +02:00
lightnvm lightnvm: pblk: add lock protection to list operations 2019-02-12 19:47:08 +01:00
macintosh
mailbox mailbox: bcm-flexrm-mailbox: Fix FlexRM ring flush timeout issue 2019-03-23 20:09:49 +01:00
mcb
md Don't jump to compute_result state from check_result state 2019-05-16 19:41:28 +02:00
media media: v4l2: i2c: ov7670: Fix PLL bypass register values 2019-05-08 07:21:55 +02:00
memory
memstick memstick: Prevent memstick host from getting runtime suspended during card detection 2019-02-12 19:47:10 +01:00
message
mfd mfd: twl-core: Disable IRQ while suspended 2019-05-08 07:21:48 +02:00
misc lkdtm: Add tests for NULL pointer dereference 2019-04-20 09:16:04 +02:00
mmc mmc: core: Fix tag set memory leak 2019-05-22 07:37:37 +02:00
mtd mtd: spi-nor: intel-spi: Avoid crossing 4K address boundary on read/write 2019-05-22 07:37:41 +02:00
mux
net tuntap: synchronize through tfiles array instead of tun->numqueues 2019-05-16 19:41:30 +02:00
nfc spi: ST ST95HF NFC: declare missing of table 2019-05-16 19:41:25 +02:00
ntb
nubus
nvdimm libnvdimm/pmem: fix a possible OOB access when read and write pmem 2019-05-16 19:41:20 +02:00
nvme nvme-fc: correct csn initialization and increments on error 2019-05-10 17:54:09 +02:00
nvmem nvmem: check the return value of nvmem_add_cells() 2018-11-13 11:08:35 -08:00
of of: overlay: do not duplicate properties from overlay for new nodes 2019-02-06 17:30:16 +01:00
opp OPP: Use opp_table->regulators to verify no regulator case 2019-02-12 19:47:08 +01:00
oprofile
parisc
parport parport_pc: fix find_superio io compare code, should use equal test. 2019-03-23 20:10:05 +01:00
pci PCI: hv: Add pci_destroy_slot() in pci_devices_present_work(), if necessary 2019-05-16 19:41:32 +02:00
pcmcia pcmcia: Implement CLKRUN protocol disabling for Ricoh bridges 2018-11-13 11:08:17 -08:00
perf perf/aux: Make perf_event accessible to setup_aux() 2019-04-05 22:33:11 +02:00
phy phy: sun4i-usb: Support set_mode to USB_HOST for non-OTG PHYs 2019-04-03 06:26:27 +02:00
pinctrl pinctrl: core: make sure strcmp() doesn't get a null parameter 2019-04-20 09:16:01 +02:00
platform platform/x86: dell-laptop: fix rfkill functionality 2019-05-16 19:41:18 +02:00
pnp
power power: supply: axp288_fuel_gauge: Add ACEPC T8 and T11 mini PCs to the blacklist 2019-05-22 07:37:35 +02:00
powercap x86/cpu: Sanitize FAM6_ATOM naming 2019-05-14 19:17:53 +02:00
pps
ps3
ptp ptp: Fix pass zero to ERR_PTR() in ptp_clock_register 2019-02-12 19:47:01 +01:00
pwm
rapidio
ras
regulator regulator: act8865: Fix act8600_sudcdc_voltage_ranges setting 2019-04-05 22:33:15 +02:00
remoteproc remoteproc: qcom: q6v5: Propagate EPROBE_DEFER 2018-11-13 11:08:52 -08:00
reset reset: meson-audio-arb: Fix missing .owner setting of reset_controller_dev 2019-05-08 07:21:47 +02:00
rpmsg rpmsg: smd: fix memory leak on channel create 2018-11-13 11:08:55 -08:00
rtc rtc: da9063: set uie_unsupported when relevant 2019-05-08 07:21:49 +02:00
s390 s390: ctcm: fix ctcm_new_device error return code 2019-05-16 19:41:24 +02:00
sbus drivers/sbus/char: add of_node_put() 2018-12-21 14:15:17 +01:00
scsi scsi: aic7xxx: fix EISA support 2019-05-16 19:41:23 +02:00
sfi
sh
siox
slimbus slimbus: ngd: mark PM functions as __maybe_unused 2018-12-19 19:19:49 +01:00
sn
soc soc: sunxi: Fix missing dependency on REGMAP_MMIO 2019-05-10 17:54:10 +02:00
soundwire
spi spi: pxa2xx: Setup maximum supported DMA transfer length 2019-03-23 20:09:57 +01:00
spmi
ssb
staging staging: most: cdev: fix chrdev_region leak in mod_exit 2019-05-10 17:54:05 +02:00
target scsi: target/iscsi: Avoid iscsit_release_commands_from_conn() deadlock 2019-03-23 20:09:59 +01:00
tc TC: Set DMA masks for devices 2018-11-13 11:08:51 -08:00
tee tee: optee: avoid possible double list_del() 2019-02-12 19:47:08 +01:00
thermal x86/cpu: Sanitize FAM6_ATOM naming 2019-05-14 19:17:53 +02:00
thunderbolt thunderbolt: Prevent root port runtime suspend during NVM upgrade 2018-12-17 09:24:36 +01:00
tty tty/vt: fix write/write race in ioctl(KDSKBSENT) handler 2019-05-22 07:37:41 +02:00
uio uio: Fix an Oops on load 2018-11-27 16:13:09 +01:00
usb usb: typec: Fix unchecked return value 2019-05-16 19:41:26 +02:00
uwb
vfio vfio/pci: use correct format characters 2019-05-08 07:21:49 +02:00
vhost vhost: reject zero size iova range 2019-04-27 09:36:31 +02:00
video backlight: pwm_bl: Use gpiod_get_value_cansleep() to get initial state 2019-04-05 22:33:13 +02:00
virt drivers/virt/fsl_hypervisor.c: prevent integer overflow in ioctl 2019-05-16 19:41:31 +02:00
virtio virtio_pci: fix a NULL pointer reference in vp_del_vqs 2019-05-10 17:54:08 +02:00
visorbus
vlynq
vme
w1 USB: w1 ds2490: Fix bug caused by improper use of altsetting array 2019-05-08 07:21:43 +02:00
watchdog watchdog: mt7621_wdt/rt2880_wdt: Fix compilation problem 2019-02-27 10:08:52 +01:00
xen fs: stream_open - opener for stream-like files so that read and write can run simultaneously without deadlock 2019-05-08 07:21:51 +02:00
zorro
Kconfig
Makefile