github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-10-24 16:55:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
6c95ca52f2
linux/drivers
History
Hui Peng 39495ef5d6 vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection() 
In paste_selection(), the loop copies min_t(unsigned int,
vc_sel.buf_len - pasted,tty->receive_room) bytes per iteration into
tty_ldisc_receive_buf() and increments pasted += count.

Because the selection mutex (vc_sel.lock) is dropped inside the loop
Whenever the line discipline buffer fills up and paste_selection()
sleeps on tty->write_wait, a concurrent TIOCLINUX (TIOCL_SETSEL) ioctl
can replace vc_sel.buffer with a shorter selection and reduce
vc_sel.buf_len below pasted.

When paste_selection() resumes, vc_sel.buf_len - pasted underflows as an
unsigned integer to a large positive value, causing
tty_ldisc_receive_buf(ld, vc_sel.buffer + pasted, NULL, count) to read
up to 4094 bytes out-of-bounds past the newly allocated vc_sel.buffer.

Fix this by terminating the loop when pasted >= vc_sel.buf_len.

Kernel stack trace (Linux 7.3.0-rc3):
 ==================================================================
 BUG: KASAN: slab-out-of-bounds in n_tty_receive_buf_common+0xa01/0x1650
 Read of size 4094 at addr ffff888101c58010 by task kworker/u17:1/65
 Workqueue: events_unbound flush_to_ldisc
 Call Trace:
  <TASK>
  dump_stack_lvl+0x70/0xa0
  print_report+0x153/0x4c6
  kasan_report+0xf1/0x120
  kasan_check_range+0x11c/0x200
  __asan_memcpy+0x29/0x70
  n_tty_receive_buf_common+0xa01/0x1650
  tty_ldisc_receive_buf+0x66/0x110
  tty_port_default_receive_buf+0x6b/0xb0
  flush_to_ldisc+0x1b4/0x410
  process_one_work+0x6ff/0x1110
  worker_thread+0x4a8/0xb70
  kthread+0x307/0x3e0
  ret_from_fork+0x3ed/0x680
  </TASK>
 ==================================================================

Fixes: e8c75a30a2 ("vt: selection, push sel_lock up")
Cc: stable <stable@kernel.org>
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
Link: https://patch.msgid.link/20260919110041.3763078-1-benquike@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-10-01 11:15:46 +02:00
..
accel Merge drm/drm-fixes into drm-misc-fixes 2026-09-08 13:32:08 +02:00
accessibility
acpi treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
amba
android Char/Misc/IIO/etc driver update for 7.3-rc1 2026-08-25 09:38:50 -07:00
ata ata: libata-scsi: do not raise UA for storage element depopulation and restoration 2026-09-03 16:10:44 +02:00
atm
auxdisplay auxdisplay for v7.3-1 2026-08-24 08:15:59 -07:00
base kmalloc_obj conversions for v7.3-rc2 2026-09-05 20:45:18 -07:00
bcma
block block-7.3-20260911 2026-09-11 12:38:44 -07:00
bluetooth Bluetooth: btusb: Fix leaked runtime PM reference in btusb_reset 2026-09-08 17:18:47 -04:00
bus Char/Misc/IIO/etc driver update for 7.3-rc1 2026-08-25 09:38:50 -07:00
cache
cdrom
cdx
char virtio_console: do not free control-out buffers on remove 2026-09-07 18:54:02 -04:00
clk treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
clocksource hyperv-next for v7.3-rc1 2026-08-26 16:47:40 -07:00
comedi
connector
counter Char/Misc/IIO/etc driver update for 7.3-rc1 2026-08-25 09:38:50 -07:00
cpufreq Merge branch 'pm-cpufreq' 2026-09-10 20:16:37 +02:00
cpuidle cpuidle: dt_idle_genpd: kfree() the original name allocation 2026-09-01 17:28:56 +02:00
crypto treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
cxl
dax mm.git review status for mm-hotfixes-stable..mm-stable 2026-08-20 18:17:08 -07:00
dca
devfreq treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
dibs dibs: Unregister dibs_class after error 2026-09-04 16:12:24 -07:00
dio
dma treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
dma-buf kmalloc_obj conversions for v7.3-rc2 2026-09-05 20:45:18 -07:00
dpll Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-08-18 10:42:41 -07:00
edac EDAC/altera: Use parent device for devres in altr_portb_setup() 2026-09-07 21:29:44 -07:00
eisa
extcon
firewire firewire updates for v7.3 2026-08-22 08:41:28 -07:00
firmware treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
fpga treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
fsi
fwctl rust: introduce abstractions for fwctl 2026-08-14 19:21:17 -03:00
gnss
gpib Char/Misc/IIO/etc driver update for 7.3-rc1 2026-08-25 09:38:50 -07:00
gpio treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
gpu Rust fixes for v7.3 (2nd) 2026-09-13 09:28:28 -07:00
greybus
hid treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
hsi HSI changes for the 7.3 series 2026-08-21 12:01:23 -07:00
hte
hv treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
hwmon hwmon: (nct6694) do not expose enable on DTIN temperature channels 2026-09-09 18:16:35 -07:00
hwspinlock
hwtracing treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
i2c treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
i3c treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
idle Merge branch 'intel-idle-lpi' 2026-08-07 21:22:50 +02:00
iio treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
infiniband treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
input treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
interconnect This pull request contains the following interconnect updates for 2026-08-19 09:55:37 +02:00
iommu iommu/amd: Remove unused macro 2026-09-11 17:27:22 +02:00
ipack Char/Misc/IIO/etc driver update for 7.3-rc1 2026-08-25 09:38:50 -07:00
irqchip irqchip/gic-v5: Preserve ICC_CR0_EL1 state 2026-09-07 21:44:17 +02:00
leds LEDs for v7.3 2026-08-27 11:05:51 -07:00
macintosh
mailbox treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
mcb
md treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
media media: ipu-bridge: do not use the CVS device lookup for IVSC 2026-09-13 10:15:16 -07:00
memory * Raw NAND changes 2026-08-23 09:11:21 -07:00
memstick
message
mfd treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
misc Merge drm/drm-fixes into drm-misc-fixes 2026-09-01 09:38:51 +02:00
mmc MMC core: 2026-08-21 11:58:08 -07:00
most
mtd treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
mux
net wifi: mt76: mt792x: fix NULL dereference in ACPI SAR init during probe 2026-09-13 10:15:16 -07:00
nfc Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-08-18 10:42:41 -07:00
ntb NTB: ntb_transport: Reject oversized TX buffers 2026-08-20 13:43:24 -07:00
nubus
nvdimm treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
nvme kmalloc_obj conversions for v7.3-rc2 2026-09-05 20:45:18 -07:00
nvmem Char/Misc/IIO/etc driver update for 7.3-rc1 2026-08-25 09:38:50 -07:00
of Devicetree fixes for v7.3, part 1: 2026-08-27 12:53:43 -07:00
opp OPP updates for 7.3-rc2 2026-09-09 19:03:00 +02:00
parisc parisc: eisa: Fix infinite loop when parsing invalid IRQ value 2026-08-18 11:43:05 +02:00
parport
pci treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
pcmcia
peci
perf perf: RISC-V: check cpu_hw_evt before dereference in overflow IRQ 2026-09-01 19:19:48 -06:00
phy Mostly the usual clk driver updates and new SoC additions plus non-critical 2026-08-26 11:14:30 -07:00
pinctrl Pin control bulk changes for kernel v7.3 2026-08-24 08:46:03 -07:00
platform platform-drivers-x86 for v7.3-2 2026-09-11 12:52:48 -07:00
pmdomain treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
pnp Merge branches 'acpi-numa', 'acpi-misc' and 'pnp' 2026-08-07 20:01:31 +02:00
power treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
powercap More power management updates for 7.3-rc1 2026-08-26 14:13:26 -07:00
pps
ps3
ptp treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
pwm Driver core changes for 7.3-rc1 2026-08-19 10:42:18 -07:00
rapidio
ras - Mark the mpc85xx and ThunderX EDAC drivers as orphaned due to lack of 2026-08-31 20:10:39 -07:00
regulator regulator: pf1550: fix which regulator is notified 2026-09-07 18:08:38 +01:00
remoteproc
resctrl arm64 updates for 7.3 2026-08-18 11:57:17 -07:00
reset Mostly the usual clk driver updates and new SoC additions plus non-critical 2026-08-26 11:14:30 -07:00
rpmsg
rtc RTC for 7.3 2026-08-28 09:53:43 -07:00
s390 Nothing too exciting, usual stream of fixes. 2026-09-10 14:07:48 -07:00
sbus
scsi kmalloc_obj conversions for v7.3-rc2 2026-09-05 20:45:18 -07:00
sh
siox
slimbus
soc treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
soundwire soundwire updates for 7.3 2026-08-24 12:16:16 -07:00
spi treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
spmi
ssb
staging tty: fix saved termios reset race 2026-10-01 11:05:17 +02:00
target scsi: target: iscsi: Reserve a terminator byte for the login payload 2026-09-01 22:08:31 -04:00
tc
tee treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
thermal thermal: sysfs: switch to use scnprintf() to suppress truncation warning 2026-09-04 15:49:46 +02:00
thunderbolt treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
tty vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection() 2026-10-01 11:15:46 +02:00
ufs kmalloc_obj conversions for v7.3-rc2 2026-09-05 20:45:18 -07:00
uio
usb tty: fix saved termios reset race 2026-10-01 11:05:17 +02:00
vdpa vduse: return compat ioctl results directly 2026-09-08 03:58:27 -04:00
vfio mm.git review status for mm-hotfixes-stable..mm-stable 2026-08-20 18:17:08 -07:00
vhost vhost: invalidate vring access on IOTLB transitions 2026-09-07 18:54:04 -04:00
video fbdev fixes for 7.3-rc3: 2026-09-12 08:06:04 -07:00
virt arm64 updates for 7.3 2026-08-18 11:57:17 -07:00
virtio virtio_input: stop callbacks before unregistering input device 2026-09-07 18:54:04 -04:00
w1
watchdog watchdog: msc313e: Sync timeout value if WDT was running at boot 2026-09-09 14:18:25 -07:00
xen treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
zorro
Kconfig
Makefile