linux-stable.git/drivers/tty/tty_ldisc.c, branch linux-4.5.y

tty: Prevent ldisc drivers from re-using stale tty fields

2015-12-14T03:59:48+00:00

Line discipline drivers may mistakenly misuse ldisc-related fields
when initializing. For example, a failure to initialize tty->receive_room
in the N_GIGASET_M101 line discipline was recently found and fixed [1].
Now, the N_X25 line discipline has been discovered accessing the previous
line discipline's already-freed private data [2].

Harden the ldisc interface against misuse by initializing revelant
tty fields before instancing the new line discipline.

[1]
    commit fd98e9419d8d622a4de91f76b306af6aa627aa9c
    Author: Tilman Schmidt 
    Date:   Tue Jul 14 00:37:13 2015 +0200

    isdn/gigaset: reset tty->receive_room when attaching ser_gigaset

[2] Report from Sasha Levin 
    [  634.336761] ==================================================================
    [  634.338226] BUG: KASAN: use-after-free in x25_asy_open_tty+0x13d/0x490 at addr ffff8800a743efd0
    [  634.339558] Read of size 4 by task syzkaller_execu/8981
    [  634.340359] =============================================================================
    [  634.341598] BUG kmalloc-512 (Not tainted): kasan: bad access detected
    ...
    [  634.405018] Call Trace:
    [  634.405277] dump_stack (lib/dump_stack.c:52)
    [  634.405775] print_trailer (mm/slub.c:655)
    [  634.406361] object_err (mm/slub.c:662)
    [  634.406824] kasan_report_error (mm/kasan/report.c:138 mm/kasan/report.c:236)
    [  634.409581] __asan_report_load4_noabort (mm/kasan/report.c:279)
    [  634.411355] x25_asy_open_tty (drivers/net/wan/x25_asy.c:559 (discriminator 1))
    [  634.413997] tty_ldisc_open.isra.2 (drivers/tty/tty_ldisc.c:447)
    [  634.414549] tty_set_ldisc (drivers/tty/tty_ldisc.c:567)
    [  634.415057] tty_ioctl (drivers/tty/tty_io.c:2646 drivers/tty/tty_io.c:2879)
    [  634.423524] do_vfs_ioctl (fs/ioctl.c:43 fs/ioctl.c:607)
    [  634.427491] SyS_ioctl (fs/ioctl.c:622 fs/ioctl.c:613)
    [  634.427945] entry_SYSCALL_64_fastpath (arch/x86/entry/entry_64.S:188)

Cc: Tilman Schmidt 
Cc: Sasha Levin 
Signed-off-by: Peter Hurley 
Signed-off-by: Greg Kroah-Hartman

tty: Simplify tty_set_ldisc() exit handling

2015-12-14T03:59:48+00:00

Perform common exit for both successful and error exit handling
in tty_set_ldisc(). Fixes unlikely possibility of failing to restart
input kworker when switching to the same line discipline (noop case).

Signed-off-by: Peter Hurley 
Signed-off-by: Greg Kroah-Hartman

tty/tty_ldisc: Deinline tty_ldisc_put, save 368 bytes

2015-12-14T03:59:48+00:00

This function compiles to 72 bytes of machine code.

Signed-off-by: Denys Vlasenko 
CC: Jiri Slaby 
CC: linux-serial@vger.kernel.org
Reviewed-by: Peter Hurley 
Signed-off-by: Greg Kroah-Hartman

tty: Fix direct use of tty buffer work

2015-11-21T00:19:54+00:00

Recent abstraction of tty buffer work introduced api to manage
tty input kworker; use it.

Fixes: e176058f0de5 ("tty: Abstract tty buffer work")
Signed-off-by: Peter Hurley 
Signed-off-by: Greg Kroah-Hartman

tty: remove unneeded return statement

2015-10-18T04:29:21+00:00

Signed-off-by: Guillaume Gomez 
Signed-off-by: Greg Kroah-Hartman

tty: core: Improve ldisc debug messages

2015-07-24T01:37:31+00:00

Add debug messages for ldisc open and close, and remove
"closing ldisc" message from tty_ldisc_release(), because a
close message is now printed for both ldiscs; always print ldisc
pointer first so ldisc changes are easier to identify.

Signed-off-by: Peter Hurley 
Signed-off-by: Greg Kroah-Hartman

tty: Use tty_debug() for tty_ldisc_debug()

2015-07-24T01:37:31+00:00

Replace tty_ldisc_debug() macro definition; substitute with equivalent
tty_debug() invocation.

Signed-off-by: Peter Hurley 
Signed-off-by: Greg Kroah-Hartman

tty: remove buf parameter from tty_name()

2015-05-06T20:26:57+00:00

tty_name no longer uses the buf parameter, so remove it along with all
the 64 byte stack buffers that used to be passed in.

Mostly generated by the coccinelle script

@depends on patch@
identifier buf;
constant C;
expression tty;
@@
- char buf[C];
  <+...
- tty_name(tty, buf)
+ tty_name(tty)
  ...+>

allmodconfig compiles, so I'm fairly confident the stack buffers
weren't used for other purposes as well.

Signed-off-by: Rasmus Villemoes 
Reviewed-by: Peter Hurley 
Acked-by: Jesper Nilsson 
Acked-by: Dmitry Torokhov 
Signed-off-by: Greg Kroah-Hartman

tty: Allow safe access to termios for set_ldisc() handlers

2014-11-06T22:57:27+00:00

Allow a tty driver to safely access termios settings while handling
the set_ldisc() notification. UART drivers use the set_ldisc()
notification to check if the N_PPS line discipline is being enabled;
if so, modem status interrupts may also need to be enabled. Conversely,
modem status interrupts may need to be disabled if switching away
from the N_PPS line discipline.

Signed-off-by: Peter Hurley 
Signed-off-by: Greg Kroah-Hartman

tty: Flush ldisc buffer atomically with tty flip buffers

2014-11-06T02:50:43+00:00

tty_ldisc_flush() first clears the line discipline input buffer,
then clears the tty flip buffers. However, this allows for existing
data in the tty flip buffers to be added after the ldisc input
buffer has been cleared, but before the flip buffers have been cleared.

Add an optional ldisc parameter to tty_buffer_flush() to allow
tty_ldisc_flush() to pass the ldisc to clear.

NB: Initially, the plan was to do this automatically in
tty_buffer_flush(). However, an audit of the behavior of existing
line disciplines showed that performing a ldisc buffer flush on
ioctl(TCFLSH) was not always the outcome. For example, some line
disciplines have flush_buffer() methods but not ioctl() methods,
so a ->flush_buffer() command would be unexpected.

Reviewed-by: Alan Cox 
Signed-off-by: Peter Hurley 
Signed-off-by: Greg Kroah-Hartman