[kernel] r15920 - in dists/lenny-security/linux-2.6/debian: . patches/bugfix/all patches/series

[Dann Frazier]

Author: dannf
Date: Thu Jul  1 04:15:21 2010
New Revision: 15920

Log:
Fix race in tty_fasync() properly (CVE-2009-4895)

Added:
   dists/lenny-security/linux-2.6/debian/patches/bugfix/all/fix-race-in-tty_fasync-properly.patch
Modified:
   dists/lenny-security/linux-2.6/debian/changelog
   dists/lenny-security/linux-2.6/debian/patches/series/24lenny1

Modified: dists/lenny-security/linux-2.6/debian/changelog
==============================================================================
--- dists/lenny-security/linux-2.6/debian/changelog	Thu Jul  1 00:12:25 2010	(r15919)
+++ dists/lenny-security/linux-2.6/debian/changelog	Thu Jul  1 04:15:21 2010	(r15920)
@@ -1,6 +1,7 @@
 linux-2.6 (2.6.26-24lenny1) UNRELEASED; urgency=high
 
   * cifs: Fix a kernel BUG with remote OS/2 server (CVE-2010-2248)
+  * Fix race in tty_fasync() properly (CVE-2009-4895)
 
  -- dann frazier <dannf at debian.org>  Wed, 30 Jun 2010 00:32:02 -0600
 

Added: dists/lenny-security/linux-2.6/debian/patches/bugfix/all/fix-race-in-tty_fasync-properly.patch
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ dists/lenny-security/linux-2.6/debian/patches/bugfix/all/fix-race-in-tty_fasync-properly.patch	Thu Jul  1 04:15:21 2010	(r15920)
@@ -0,0 +1,55 @@
+commit 769a693ecea9c4821b8fdb297b211d09740cc191
+Author: Linus Torvalds <torvalds at linux-foundation.org>
+Date:   Sun Feb 7 10:11:23 2010 -0800
+
+    Fix race in tty_fasync() properly
+    
+    This reverts commit 703625118069 ("tty: fix race in tty_fasync") and
+    commit b04da8bfdfbb ("fnctl: f_modown should call write_lock_irqsave/
+    restore") that tried to fix up some of the fallout but was incomplete.
+    
+    It turns out that we really cannot hold 'tty->ctrl_lock' over calling
+    __f_setown, because not only did that cause problems with interrupt
+    disables (which the second commit fixed), it also causes a potential
+    ABBA deadlock due to lock ordering.
+    
+    Thanks to Tetsuo Handa for following up on the issue, and running
+    lockdep to show the problem.  It goes roughly like this:
+    
+     - f_getown gets filp->f_owner.lock for reading without interrupts
+       disabled, so an interrupt that happens while that lock is held can
+       cause a lockdep chain from f_owner.lock -> sighand->siglock.
+    
+     - at the same time, the tty->ctrl_lock -> f_owner.lock chain that
+       commit 703625118069 introduced, together with the pre-existing
+       sighand->siglock -> tty->ctrl_lock chain means that we have a lock
+       dependency the other way too.
+    
+    So instead of extending tty->ctrl_lock over the whole __f_setown() call,
+    we now just take a reference to the 'pid' structure while holding the
+    lock, and then release it after having done the __f_setown.  That still
+    guarantees that 'struct pid' won't go away from under us, which is all
+    we really ever needed.
+    
+    Reported-and-tested-by: Tetsuo Handa <penguin-kernel at I-love.SAKURA.ne.jp>
+    Acked-by: Greg Kroah-Hartman <gregkh at suse.de>
+    Acked-by: Américo Wang <xiyou.wangcong at gmail.com>
+    Cc: stable at kernel.org
+    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
+    Backported-to-Debian's-2.6.26-by: dann frazier <dannf at debian.org>
+
+diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
+index 60b691e..ced3fab 100644
+--- a/drivers/char/tty_io.c
++++ b/drivers/char/tty_io.c
+@@ -2911,8 +2911,10 @@ static int tty_fasync(int fd, struct file *filp, int on)
+ 			pid = task_pid(current);
+ 			type = PIDTYPE_PID;
+ 		}
++		get_pid(pid);
+ 		spin_unlock_irqrestore(&tty->ctrl_lock, flags);
+ 		retval = __f_setown(filp, pid, type, 0);
++		put_pid(pid);
+ 		if (retval)
+ 			return retval;
+ 	} else {

Modified: dists/lenny-security/linux-2.6/debian/patches/series/24lenny1
==============================================================================
--- dists/lenny-security/linux-2.6/debian/patches/series/24lenny1	Thu Jul  1 00:12:25 2010	(r15919)
+++ dists/lenny-security/linux-2.6/debian/patches/series/24lenny1	Thu Jul  1 04:15:21 2010	(r15920)
@@ -1 +1,2 @@
 + bugfix/all/cifs-fix-a-kernel-bug-with-remote-os-2-server-try-3.patch
++ bugfix/all/fix-race-in-tty_fasync-properly.patch