linux

mirror of https://github.com/torvalds/linux.git synced 2026-06-09 07:03:37 +02:00

Linux kernel source tree

Go to file

Jiri Slaby 31559b5904 vt: selection, close sel_buffer race commit `07e6124a1a` upstream. syzkaller reported this UAF: BUG: KASAN: use-after-free in n_tty_receive_buf_common+0x2481/0x2940 drivers/tty/n_tty.c:1741 Read of size 1 at addr ffff8880089e40e9 by task syz-executor.1/13184 CPU: 0 PID: 13184 Comm: syz-executor.1 Not tainted 5.4.7 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 Call Trace: ... kasan_report+0xe/0x20 mm/kasan/common.c:634 n_tty_receive_buf_common+0x2481/0x2940 drivers/tty/n_tty.c:1741 tty_ldisc_receive_buf+0xac/0x190 drivers/tty/tty_buffer.c:461 paste_selection+0x297/0x400 drivers/tty/vt/selection.c:372 tioclinux+0x20d/0x4e0 drivers/tty/vt/vt.c:3044 vt_ioctl+0x1bcf/0x28d0 drivers/tty/vt/vt_ioctl.c:364 tty_ioctl+0x525/0x15a0 drivers/tty/tty_io.c:2657 vfs_ioctl fs/ioctl.c:47 [inline] It is due to a race between parallel paste_selection (TIOCL_PASTESEL) and set_selection_user (TIOCL_SETSEL) invocations. One uses sel_buffer, while the other frees it and reallocates a new one for another selection. Add a mutex to close this race. The mutex takes care properly of sel_buffer and sel_buffer_lth only. The other selection global variables (like sel_start, sel_end, and sel_cons) are protected only in set_selection_user. The other functions need quite some more work to close the races of the variables there. This is going to happen later. This likely fixes (I am unsure as there is no reproducer provided) bug 206361 too. It was marked as CVE-2020-8648. Signed-off-by: Jiri Slaby <jslaby@suse.cz> Reported-by: syzbot+59997e8d5cbdc486e6f6@syzkaller.appspotmail.com References: https://bugzilla.kernel.org/show_bug.cgi?id=206361 Cc: stable <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20200210081131.23572-2-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2020-03-11 14:15:02 +01:00
arch	arm: dts: dra76x: Fix mmc3 max-frequency	2020-03-11 14:15:01 +01:00
block	block: fix 32 bit overflow in __blkdev_issue_discard()	2020-02-01 09:37:12 +00:00
certs	export.h: remove VMLINUX_SYMBOL() and VMLINUX_SYMBOL_STR()	2018-08-22 23:21:44 +09:00
crypto	crypto: api - Fix race condition in crypto_spawn_alg	2020-02-11 04:34:05 -08:00
Documentation	netfilter: nf_flowtable: fix documentation	2020-03-05 16:42:23 +01:00
drivers	vt: selection, close sel_buffer race	2020-03-11 14:15:02 +01:00
firmware	Fix built-in early-load Intel microcode alignment	2020-01-23 08:21:29 +01:00
fs	fat: fix uninit-memory access for partial initialized inode	2020-03-11 14:15:01 +01:00
include	usb: charger: assign specific number for enum value	2020-03-05 16:42:20 +01:00
init	fork: fix some -Wmissing-prototypes warnings	2019-12-05 09:21:04 +01:00
ipc	Revert "ipc,sem: remove uneeded sem_undo_list lock usage in exit_sem()"	2020-02-28 16:38:49 +01:00
kernel	kprobes: Fix optimize_kprobe()/unoptimize_kprobe() cancellation logic	2020-03-11 14:14:47 +01:00
lib	lib/stackdepot.c: fix global out-of-bounds in stack_slabs	2020-02-28 16:38:55 +01:00
LICENSES	LICENSES: Remove CC-BY-SA-4.0 license text	2018-10-18 11:28:50 +02:00
mm	mm: fix possible PMD dirty bit lost in set_pmd_migration_entry()	2020-03-11 14:15:00 +01:00
net	netfilter: nft_tunnel: no need to call htons() when dumping ports	2020-03-05 16:42:23 +01:00
samples	samples/bpf: Don't try to remove user's homedir on clean	2020-02-11 04:34:05 -08:00
scripts	kbuild: use -S instead of -E for precise cc-option test in Kconfig	2020-02-24 08:34:50 +01:00
security	selinux: ensure we cleanup the internal AVC counters on error in avc_update()	2020-02-24 08:34:43 +01:00
sound	ALSA: hda/realtek - Fix silent output on Gigabyte X570 Aorus Master	2020-03-11 14:14:57 +01:00
tools	selftests: forwarding: use proto icmp for {gretap, ip6gretap}_mac testing	2020-03-11 14:14:51 +01:00
usr	kbuild: clean compressed initramfs image	2019-10-07 18:57:16 +02:00
virt	KVM: Check for a bad hva before dropping into the ghc slow path	2020-03-05 16:42:21 +01:00
.clang-format	clang-format: Set IndentWrappedFunctionNames false	2018-08-01 18:38:51 +02:00
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore	Kbuild updates for v4.17 (2nd)	2018-04-15 17:21:30 -07:00
.mailmap	libnvdimm-for-4.19_misc	2018-08-25 18:13:10 -07:00
COPYING	COPYING: use the new text with points to the license files	2018-03-23 12:41:45 -06:00
CREDITS	9p: remove Ron Minnich from MAINTAINERS	2018-08-17 16:20:26 -07:00
Kbuild	Kbuild updates for v4.15	2017-11-17 17:45:29 -08:00
Kconfig	kconfig: move the "Executable file formats" menu to fs/Kconfig.binfmt	2018-08-02 08:06:55 +09:00
MAINTAINERS	MAINTAINERS: Update drm/i915 bug filing URL	2020-02-28 16:38:49 +01:00
Makefile	Linux 4.19.108	2020-03-05 16:42:23 +01:00
README	Docs: Added a pointer to the formatted docs to README	2018-03-21 09:02:53 -06:00

README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.
See Documentation/00-INDEX for a list of what is contained in each file.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.