Eric Dumazet ec9645f1a7 vt: vt_ioctl: fix race in VT_RESIZEX ... commit 6cd1ed50ef upstream. We need to make sure vc_cons[i].d is not NULL after grabbing console_lock(), or risk a crash. general protection fault, probably for non-canonical address 0xdffffc0000000068: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000340-0x0000000000000347] CPU: 1 PID: 19462 Comm: syz-executor.5 Not tainted 5.5.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:vt_ioctl+0x1f96/0x26d0 drivers/tty/vt/vt_ioctl.c:883 Code: 74 41 e8 bd a6 84 fd 48 89 d8 48 c1 e8 03 42 80 3c 28 00 0f 85 e4 04 00 00 48 8b 03 48 8d b8 40 03 00 00 48 89 fa 48 c1 ea 03 <42> 0f b6 14 2a 84 d2 74 09 80 fa 03 0f 8e b1 05 00 00 44 89 b8 40 RSP: 0018:ffffc900086d7bb0 EFLAGS: 00010202 RAX: 0000000000000000 RBX: ffffffff8c34ee88 RCX: ffffc9001415c000 RDX: 0000000000000068 RSI: ffffffff83f0e6e3 RDI: 0000000000000340 RBP: ffffc900086d7cd0 R08: ffff888054ce0100 R09: fffffbfff16a2f6d R10: ffff888054ce0998 R11: ffff888054ce0100 R12: 000000000000001d R13: dffffc0000000000 R14: 1ffff920010daf79 R15: 000000000000ff7f FS: 00007f7d13c12700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffd477e3c38 CR3: 0000000095d0a000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: tty_ioctl+0xa37/0x14f0 drivers/tty/tty_io.c:2660 vfs_ioctl fs/ioctl.c:47 [inline] ksys_ioctl+0x123/0x180 fs/ioctl.c:763 __do_sys_ioctl fs/ioctl.c:772 [inline] __se_sys_ioctl fs/ioctl.c:770 [inline] __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:770 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x45b399 Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f7d13c11c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f7d13c126d4 RCX: 000000000045b399 RDX: 0000000020000080 RSI: 000000000000560a RDI: 0000000000000003 RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff R13: 0000000000000666 R14: 00000000004c7f04 R15: 000000000075bf2c Modules linked in: ---[ end trace 80970faf7a67eb77 ]--- RIP: 0010:vt_ioctl+0x1f96/0x26d0 drivers/tty/vt/vt_ioctl.c:883 Code: 74 41 e8 bd a6 84 fd 48 89 d8 48 c1 e8 03 42 80 3c 28 00 0f 85 e4 04 00 00 48 8b 03 48 8d b8 40 03 00 00 48 89 fa 48 c1 ea 03 <42> 0f b6 14 2a 84 d2 74 09 80 fa 03 0f 8e b1 05 00 00 44 89 b8 40 RSP: 0018:ffffc900086d7bb0 EFLAGS: 00010202 RAX: 0000000000000000 RBX: ffffffff8c34ee88 RCX: ffffc9001415c000 RDX: 0000000000000068 RSI: ffffffff83f0e6e3 RDI: 0000000000000340 RBP: ffffc900086d7cd0 R08: ffff888054ce0100 R09: fffffbfff16a2f6d R10: ffff888054ce0998 R11: ffff888054ce0100 R12: 000000000000001d R13: dffffc0000000000 R14: 1ffff920010daf79 R15: 000000000000ff7f FS: 00007f7d13c12700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffd477e3c38 CR3: 0000000095d0a000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Fixes: 1da177e4c3 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: stable <stable@vger.kernel.org> Reported-by: syzbot <syzkaller@googlegroups.com> Link: https://lore.kernel.org/r/20200210190721.200418-1-edumazet@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2020-02-28 16:38:45 +01:00
..
hvc	powerpc/pseries/hvconsole: Fix stack overread via udbg	2020-01-09 10:19:08 +01:00
ipwireless	tty: ipwireless: Fix potential NULL pointer dereference	2020-01-27 14:50:16 +01:00
serdev	serdev: Don't claim unsupported ACPI serial devices	2020-01-14 20:07:05 +01:00
serial	serial: uartps: Move the spinlock after the read of the tx empty	2020-02-14 16:33:28 -05:00
vt	vt: vt_ioctl: fix race in VT_RESIZEX	2020-02-28 16:38:45 +01:00
amiserial.c
cyclades.c
ehv_bytechan.c
goldfish.c
isicom.c
Kconfig	tty: ldisc: add sysctl to prevent autoloading of ldiscs	2019-04-17 08:38:47 +02:00
Makefile
mips_ejtag_fdc.c
moxa.c
moxa.h
mxser.c
mxser.h
n_gsm.c
n_hdlc.c	tty: Don't block on IO when ldisc change is pending	2019-12-13 08:52:28 +01:00
n_null.c
n_r3964.c	tty: Don't block on IO when ldisc change is pending	2019-12-13 08:52:28 +01:00
n_tracerouter.c
n_tracesink.c
n_tracesink.h
n_tty.c	tty: Don't block on IO when ldisc change is pending	2019-12-13 08:52:28 +01:00
nozomi.c
pty.c	pty: fix compat ioctls	2019-12-01 09:16:16 +01:00
rocket_int.h
rocket.c	tty: rocket: fix incorrect forward declaration of 'rp_init()'	2019-07-10 09:53:44 +02:00
rocket.h
synclink_gt.c	tty: synclink_gt: Adjust indentation in several functions	2020-02-24 08:34:47 +01:00
synclink.c
synclinkmp.c	tty: synclinkmp: Adjust indentation in several functions	2020-02-24 08:34:47 +01:00
sysrq.c
tty_audit.c
tty_baudrate.c
tty_buffer.c	tty: increase the default flip buffer limit to 2*640K	2019-04-05 22:33:13 +02:00
tty_io.c	tty: ldisc: add sysctl to prevent autoloading of ldiscs	2019-04-17 08:38:47 +02:00
tty_ioctl.c
tty_jobctrl.c
tty_ldisc.c	tty: Don't block on IO when ldisc change is pending	2019-12-13 08:52:28 +01:00
tty_ldsem.c	tty/ldsem, locking/rwsem: Add missing ACQUIRE to read_failed sleep loop	2019-08-16 10:12:50 +02:00
tty_mutex.c
tty_port.c	tty: always relink the port	2020-01-14 20:07:06 +01:00
vcc.c