diff options
Diffstat (limited to 'meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2020-29661/0001-tty-Fix-pgrp-locking-in-tiocspgrp.patch')
| -rw-r--r-- | meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2020-29661/0001-tty-Fix-pgrp-locking-in-tiocspgrp.patch | 46 |
1 files changed, 46 insertions, 0 deletions
diff --git a/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2020-29661/0001-tty-Fix-pgrp-locking-in-tiocspgrp.patch b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2020-29661/0001-tty-Fix-pgrp-locking-in-tiocspgrp.patch new file mode 100644 index 000000000..b41d6a9a1 --- /dev/null +++ b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2020-29661/0001-tty-Fix-pgrp-locking-in-tiocspgrp.patch @@ -0,0 +1,46 @@ +From c536ecd4856084604701b95bd7e3fb15f05634bf Mon Sep 17 00:00:00 2001 +From: Jann Horn <jannh@google.com> +Date: Thu, 3 Dec 2020 02:25:04 +0100 +Subject: [PATCH] tty: Fix ->pgrp locking in tiocspgrp() + +commit 54ffccbf053b5b6ca4f6e45094b942fab92a25fc upstream. + +tiocspgrp() takes two tty_struct pointers: One to the tty that userspace +passed to ioctl() (`tty`) and one to the TTY being changed (`real_tty`). +These pointers are different when ioctl() is called with a master fd. + +To properly lock real_tty->pgrp, we must take real_tty->ctrl_lock. + +This bug makes it possible for racing ioctl(TIOCSPGRP, ...) calls on +both sides of a PTY pair to corrupt the refcount of `struct pid`, +leading to use-after-free errors. + +Fixes: 47f86834bbd4 ("redo locking of tty->pgrp") +CC: stable@kernel.org +Signed-off-by: Jann Horn <jannh@google.com> +Reviewed-by: Jiri Slaby <jirislaby@kernel.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/tty/tty_jobctrl.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/tty_jobctrl.c b/drivers/tty/tty_jobctrl.c +index f8ed50a16848..af508957ff05 100644 +--- a/drivers/tty/tty_jobctrl.c ++++ b/drivers/tty/tty_jobctrl.c +@@ -494,10 +494,10 @@ static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t + if (session_of_pgrp(pgrp) != task_session(current)) + goto out_unlock; + retval = 0; +- spin_lock_irq(&tty->ctrl_lock); ++ spin_lock_irq(&real_tty->ctrl_lock); + put_pid(real_tty->pgrp); + real_tty->pgrp = get_pid(pgrp); +- spin_unlock_irq(&tty->ctrl_lock); ++ spin_unlock_irq(&real_tty->ctrl_lock); + out_unlock: + rcu_read_unlock(); + return retval; +-- +2.17.1 + |