[linux] 04/10: Fix CVE-2015-8964 and a related bug in gigaset
debian-kernel at lists.debian.org
debian-kernel at lists.debian.org
Wed Dec 28 20:44:02 UTC 2016
This is an automated email from the git hooks/post-receive script.
benh pushed a commit to branch wheezy-security
in repository linux.
commit afbffdb3a29d452c4c0ae16586d57fd509a832ec
Author: Ben Hutchings <ben at decadent.org.uk>
Date: Wed Dec 28 16:32:42 2016 +0000
Fix CVE-2015-8964 and a related bug in gigaset
gigaset used to rely on the CVE-worthy bug, so fix it first.
---
debian/changelog | 2 +
...t-reset-tty-receive_room-when-attaching-s.patch | 47 ++++++++++++++
...-ldisc-drivers-from-re-using-stale-tty-fi.patch | 75 ++++++++++++++++++++++
debian/patches/series | 2 +
4 files changed, 126 insertions(+)
diff --git a/debian/changelog b/debian/changelog
index 8e37247..f80a025 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -104,6 +104,8 @@ linux (3.2.84-1) UNRELEASED; urgency=medium
* net: avoid signed overflows for SO_{SND|RCV}BUFFORCE (CVE-2016-9793)
* sg: Fix double-free when drives detach during SG_IO (CVE-2015-8962)
* perf: Fix race in swevent hash (CVE-2015-8963)
+ * isdn/gigaset: reset tty->receive_room when attaching ser_gigaset
+ * tty: Prevent ldisc drivers from re-using stale tty fields (CVE-2015-8964)
-- Ben Hutchings <ben at decadent.org.uk> Mon, 28 Nov 2016 18:43:52 +0000
diff --git a/debian/patches/bugfix/all/isdn-gigaset-reset-tty-receive_room-when-attaching-s.patch b/debian/patches/bugfix/all/isdn-gigaset-reset-tty-receive_room-when-attaching-s.patch
new file mode 100644
index 0000000..c6b5b10
--- /dev/null
+++ b/debian/patches/bugfix/all/isdn-gigaset-reset-tty-receive_room-when-attaching-s.patch
@@ -0,0 +1,47 @@
+From: Tilman Schmidt <tilman at imap.cc>
+Date: Tue, 14 Jul 2015 00:37:13 +0200
+Subject: isdn/gigaset: reset tty->receive_room when attaching ser_gigaset
+Origin: https://git.kernel.org/linus/fd98e9419d8d622a4de91f76b306af6aa627aa9c
+
+Commit 79901317ce80 ("n_tty: Don't flush buffer when closing ldisc"),
+first merged in kernel release 3.10, caused the following regression
+in the Gigaset M101 driver:
+
+Before that commit, when closing the N_TTY line discipline in
+preparation to switching to N_GIGASET_M101, receive_room would be
+reset to a non-zero value by the call to n_tty_flush_buffer() in
+n_tty's close method. With the removal of that call, receive_room
+might be left at zero, blocking data reception on the serial line.
+
+The present patch fixes that regression by setting receive_room
+to an appropriate value in the ldisc open method.
+
+Fixes: 79901317ce80 ("n_tty: Don't flush buffer when closing ldisc")
+Signed-off-by: Tilman Schmidt <tilman at imap.cc>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+---
+ drivers/isdn/gigaset/ser-gigaset.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/drivers/isdn/gigaset/ser-gigaset.c
++++ b/drivers/isdn/gigaset/ser-gigaset.c
+@@ -526,9 +526,18 @@ gigaset_tty_open(struct tty_struct *tty)
+ cs->hw.ser->tty = tty;
+ atomic_set(&cs->hw.ser->refcnt, 1);
+ init_completion(&cs->hw.ser->dead_cmp);
+-
+ tty->disc_data = cs;
+
++ /* Set the amount of data we're willing to receive per call
++ * from the hardware driver to half of the input buffer size
++ * to leave some reserve.
++ * Note: We don't do flow control towards the hardware driver.
++ * If more data is received than will fit into the input buffer,
++ * it will be dropped and an error will be logged. This should
++ * never happen as the device is slow and the buffer size ample.
++ */
++ tty->receive_room = RBUFSIZE/2;
++
+ /* OK.. Initialization of the datastructures and the HW is done.. Now
+ * startup system and notify the LL that we are ready to run
+ */
diff --git a/debian/patches/bugfix/all/tty-prevent-ldisc-drivers-from-re-using-stale-tty-fi.patch b/debian/patches/bugfix/all/tty-prevent-ldisc-drivers-from-re-using-stale-tty-fi.patch
new file mode 100644
index 0000000..6b4fc00
--- /dev/null
+++ b/debian/patches/bugfix/all/tty-prevent-ldisc-drivers-from-re-using-stale-tty-fi.patch
@@ -0,0 +1,75 @@
+From: Peter Hurley <peter at hurleysoftware.com>
+Date: Fri, 27 Nov 2015 14:30:21 -0500
+Subject: tty: Prevent ldisc drivers from re-using stale tty fields
+Origin: https://git.kernel.org/linus/dd42bf1197144ede075a9d4793123f7689e164bc
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2015-8964
+
+Line discipline drivers may mistakenly misuse ldisc-related fields
+when initializing. For example, a failure to initialize tty->receive_room
+in the N_GIGASET_M101 line discipline was recently found and fixed [1].
+Now, the N_X25 line discipline has been discovered accessing the previous
+line discipline's already-freed private data [2].
+
+Harden the ldisc interface against misuse by initializing revelant
+tty fields before instancing the new line discipline.
+
+[1]
+ commit fd98e9419d8d622a4de91f76b306af6aa627aa9c
+ Author: Tilman Schmidt <tilman at imap.cc>
+ Date: Tue Jul 14 00:37:13 2015 +0200
+
+ isdn/gigaset: reset tty->receive_room when attaching ser_gigaset
+
+[2] Report from Sasha Levin <sasha.levin at oracle.com>
+ [ 634.336761] ==================================================================
+ [ 634.338226] BUG: KASAN: use-after-free in x25_asy_open_tty+0x13d/0x490 at addr ffff8800a743efd0
+ [ 634.339558] Read of size 4 by task syzkaller_execu/8981
+ [ 634.340359] =============================================================================
+ [ 634.341598] BUG kmalloc-512 (Not tainted): kasan: bad access detected
+ ...
+ [ 634.405018] Call Trace:
+ [ 634.405277] dump_stack (lib/dump_stack.c:52)
+ [ 634.405775] print_trailer (mm/slub.c:655)
+ [ 634.406361] object_err (mm/slub.c:662)
+ [ 634.406824] kasan_report_error (mm/kasan/report.c:138 mm/kasan/report.c:236)
+ [ 634.409581] __asan_report_load4_noabort (mm/kasan/report.c:279)
+ [ 634.411355] x25_asy_open_tty (drivers/net/wan/x25_asy.c:559 (discriminator 1))
+ [ 634.413997] tty_ldisc_open.isra.2 (drivers/tty/tty_ldisc.c:447)
+ [ 634.414549] tty_set_ldisc (drivers/tty/tty_ldisc.c:567)
+ [ 634.415057] tty_ioctl (drivers/tty/tty_io.c:2646 drivers/tty/tty_io.c:2879)
+ [ 634.423524] do_vfs_ioctl (fs/ioctl.c:43 fs/ioctl.c:607)
+ [ 634.427491] SyS_ioctl (fs/ioctl.c:622 fs/ioctl.c:613)
+ [ 634.427945] entry_SYSCALL_64_fastpath (arch/x86/entry/entry_64.S:188)
+
+Cc: Tilman Schmidt <tilman at imap.cc>
+Cc: Sasha Levin <sasha.levin at oracle.com>
+Signed-off-by: Peter Hurley <peter at hurleysoftware.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+[bwh: Backported to 3.2: adjust context]
+---
+ drivers/tty/tty_ldisc.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/tty/tty_ldisc.c
++++ b/drivers/tty/tty_ldisc.c
+@@ -424,6 +424,10 @@ EXPORT_SYMBOL_GPL(tty_ldisc_flush);
+ * they are not on hot paths so a little discipline won't do
+ * any harm.
+ *
++ * The line discipline-related tty_struct fields are reset to
++ * prevent the ldisc driver from re-using stale information for
++ * the new ldisc instance.
++ *
+ * Locking: takes termios_mutex
+ */
+
+@@ -432,6 +436,9 @@ static void tty_set_termios_ldisc(struct
+ mutex_lock(&tty->termios_mutex);
+ tty->termios->c_line = num;
+ mutex_unlock(&tty->termios_mutex);
++
++ tty->disc_data = NULL;
++ tty->receive_room = 0;
+ }
+
+ /**
diff --git a/debian/patches/series b/debian/patches/series
index 464db1b..db40441 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1109,6 +1109,8 @@ bugfix/all/net-cleanups-in-sock_setsockopt.patch
bugfix/all/net-avoid-signed-overflows-for-so_-snd-rcv-bufforce.patch
bugfix/all/sg-fix-double-free-when-drives-detach-during-sg_io.patch
bugfix/all/perf-fix-race-in-swevent-hash.patch
+bugfix/all/isdn-gigaset-reset-tty-receive_room-when-attaching-s.patch
+bugfix/all/tty-prevent-ldisc-drivers-from-re-using-stale-tty-fi.patch
# ABI maintenance
debian/perf-hide-abi-change-in-3.2.30.patch
--
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/kernel/linux.git
More information about the Kernel-svn-changes
mailing list