linux-stable.git/drivers/tty/pty.c, branch linux-3.19.y

tty: Prevent untrappable signals from malicious program

2015-03-06T22:57:32+00:00

commit 37480a05685ed5b8e1b9bf5e5c53b5810258b149 upstream.

Commit 26df6d13406d1a5 ("tty: Add EXTPROC support for LINEMODE")
allows a process which has opened a pty master to send _any_ signal
to the process group of the pty slave. Although potentially
exploitable by a malicious program running a setuid program on
a pty slave, it's unknown if this exploit currently exists.

Limit to signals actually used.

Cc: Theodore Ts'o 
Cc: Howard Chu 
Cc: One Thousand Gnomes 
Cc: Jiri Slaby 
Signed-off-by: Peter Hurley 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Greg Kroah-Hartman

pty, n_tty: Simplify input processing on final close

2014-11-06T02:50:42+00:00

When releasing one end of a pty pair, that end may just have written
to the other, which the input processing worker, flush_to_ldisc(), is
still working on but has not completed the copy to the other end's
read buffer. So input may not appear to be available to a waiting
reader but yet TTY_OTHER_CLOSED is now observed. The n_tty line
discipline has worked around this by waiting for input processing
to complete and then re-checking if input is available before
exiting with -EIO.

Since the tty/ldisc lock reordering, the wait for input processing
to complete can now occur during final close before setting
TTY_OTHER_CLOSED. In this way, a waiting reader is guaranteed to
see input available (if any) before observing TTY_OTHER_CLOSED.

Reviewed-by: Alan Cox 
Signed-off-by: Peter Hurley 
Signed-off-by: Greg Kroah-Hartman

pty: Don't drop pty master tty lock to hangup slave

2014-11-06T02:50:42+00:00

With the revised tty lock order and lockdep annotation, claiming
the pty slave lock is now safe while still holding the pty master lock.

Signed-off-by: Peter Hurley 
Signed-off-by: Greg Kroah-Hartman

tty: Preset lock subclass for nested tty locks

2014-11-06T02:50:42+00:00

Eliminate the requirement of specifying the tty lock nesting at
lock time; instead, set the lock subclass for slave ptys at pty
install (normal ttys and master ptys use subclass 0).

Signed-off-by: Peter Hurley 
Signed-off-by: Greg Kroah-Hartman

pty: Always return -EIO if slave BSD pty opened first

2014-11-06T02:24:10+00:00

Opening the slave BSD pty first already returns -EIO from the slave
pty_open(), which in turn causes the newly installed tty pair to be
released before returning from tty_open(). However, this can also
cause a parallel master BSD pty open to fail because the pty pair
destruction may already been taking place in tty_release().

Failing at driver->install() if the slave pty is opened first ensures
that a pty master open cannot fail, because the driver tables will
not have been updated so tty_driver_lookup_tty() won't find the
master pty (and attempt to "re-open" it).

In turn, this guarantees that any tty with a tty->count == 0 is
in final close (rather than never opened).

Reviewed-by: Alan Cox 
Signed-off-by: Peter Hurley 
Signed-off-by: Greg Kroah-Hartman

pty: Hold ctrl_lock for packet mode updates

2014-11-06T00:34:36+00:00

Updates to the packet mode enable require holding the ctrl_lock;
the serialization prevents corruption of adjacent fields.

Signed-off-by: Peter Hurley 
Reviewed-by: Alan Cox 
Signed-off-by: Greg Kroah-Hartman

pty: Fix packet mode setting race

2014-11-06T00:34:36+00:00

Because pty_set_pktmode() does not claim the slave's ctrl_lock
to clear ->ctrl_status (to avoid unnecessary lock nesting),
pty_set_pktmode() may accidentally erase new ->ctrl_status updates.
For example,

CPU 0                             | CPU 1
pty_set_pktmode()                 | pty_start()
  spin_lock(master's ctrl_lock)   |
  tty->packet = 1                 |
                                  |   if (tty->link->packet)
                                  |     spin_lock(slave's ctrl_lock)
                                  |     tty->ctrl_status = TIOCPKT_START
  tty->link->ctrl_status = 0      |

Ensure the clear of ->ctrl_status occurs before packet mode is set
(and observable on another cpu).

Signed-off-by: Peter Hurley 
Reviewed-by: Alan Cox 
Signed-off-by: Greg Kroah-Hartman

pty: Don't claim slave's ctrl_lock for master's packet mode

2014-11-06T00:34:36+00:00

The slave's ctrl_lock serializes updates to the ctrl_status field
only, whereas the master's ctrl_lock serializes updates to the
packet mode enable (ie., the master does not have ctrl_status and
the slave does not have packet mode). Thus, claiming the slave's
ctrl_lock to access ->packet is useless.

Unlocked reads of ->packet are already smp-safe.

Signed-off-by: Peter Hurley 
Reviewed-by: Alan Cox 
Signed-off-by: Greg Kroah-Hartman

tty: Use spin_lock_irq() for ctrl_lock when interrupts enabled

2014-11-06T00:34:36+00:00

Interrupts are enabled in the n_tty_read() loop, ioctl(TIOCPKT)
and pty driver flush_buffer() routine; no need to save and restore
local interrupt state.

Signed-off-by: Peter Hurley 
Reviewed-by: Alan Cox 
Signed-off-by: Greg Kroah-Hartman

pty: Use spin_lock_irq() for pty_set_termios()

2014-11-06T00:34:36+00:00

The tty driver's set_termios() method is called with interrupts
enabled; there is no need to save and restore the local interrupt state.

Signed-off-by: Peter Hurley 
Reviewed-by: Alan Cox 
Signed-off-by: Greg Kroah-Hartman