From 5b0afd4bc0e9ea3f8222ec846eb61a1895e913d9 Mon Sep 17 00:00:00 2001 From: Linus Torvalds Date: Thu, 15 Aug 2024 14:04:42 +0000 Subject: [PATCH 1/2] tty: add the option to have a tty reject a new ldisc mainline inclusion from mainline-v6.10-rc1 commit 6bd23e0c2bb6c65d4f5754d1456bc9a4427fc59b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IACT4T CVE: CVE-2024-40966 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6bd23e0c2bb6c65d4f5754d1456bc9a4427fc59b -------------------------------- ... and use it to limit the virtual terminals to just N_TTY. They are kind of special, and in particular, the "con_write()" routine violates the "writes cannot sleep" rule that some ldiscs rely on. This avoids the BUG: sleeping function called from invalid context at kernel/printk/printk.c:2659 when N_GSM has been attached to a virtual console, and gsmld_write() calls con_write() while holding a spinlock, and con_write() then tries to get the console lock. Tested-by: Tetsuo Handa Cc: Jiri Slaby Cc: Andrew Morton Cc: Daniel Starke Reported-by: syzbot Closes: https://syzkaller.appspot.com/bug?extid=dbac96d8e73b61aa559c Signed-off-by: Linus Torvalds Link: https://lore.kernel.org/r/20240423163339.59780-1-torvalds@linux-foundation.org Signed-off-by: Greg Kroah-Hartman Conflicts: include/linux/tty_driver.h [Not merge commit 1fe183091753 ("tty: add kernel-doc for tty_operations"),and context conflicts] Signed-off-by: Yi Yang --- drivers/tty/tty_ldisc.c | 6 ++++++ drivers/tty/vt/vt.c | 10 ++++++++++ include/linux/tty_driver.h | 1 + 3 files changed, 17 insertions(+) diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c index c23938b8628d..dc5267ac9923 100644 --- a/drivers/tty/tty_ldisc.c +++ b/drivers/tty/tty_ldisc.c @@ -579,6 +579,12 @@ int tty_set_ldisc(struct tty_struct *tty, int disc) goto out; } + if (tty->ops->ldisc_ok) { + retval = tty->ops->ldisc_ok(tty, disc); + if (retval) + goto out; + } + old_ldisc = tty->ldisc; /* Shutdown the old discipline. */ diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c index 33fb7b6555f4..34f3f752f0b2 100644 --- a/drivers/tty/vt/vt.c +++ b/drivers/tty/vt/vt.c @@ -3448,6 +3448,15 @@ static void con_cleanup(struct tty_struct *tty) tty_port_put(&vc->port); } +/* + * We can't deal with anything but the N_TTY ldisc, + * because we can sleep in our write() routine. + */ +static int con_ldisc_ok(struct tty_struct *tty, int ldisc) +{ + return ldisc == N_TTY ? 0 : -EINVAL; +} + static int default_color = 7; /* white */ static int default_italic_color = 2; // green (ASCII) static int default_underline_color = 3; // cyan (ASCII) @@ -3576,6 +3585,7 @@ static const struct tty_operations con_ops = { .resize = vt_resize, .shutdown = con_shutdown, .cleanup = con_cleanup, + .ldisc_ok = con_ldisc_ok, }; static struct cdev vc0_cdev; diff --git a/include/linux/tty_driver.h b/include/linux/tty_driver.h index 2f719b471d52..c80e82a93577 100644 --- a/include/linux/tty_driver.h +++ b/include/linux/tty_driver.h @@ -256,6 +256,7 @@ struct tty_operations { const unsigned char *buf, int count); int (*put_char)(struct tty_struct *tty, unsigned char ch); void (*flush_chars)(struct tty_struct *tty); + int (*ldisc_ok)(struct tty_struct *tty, int ldisc); int (*write_room)(struct tty_struct *tty); int (*chars_in_buffer)(struct tty_struct *tty); int (*ioctl)(struct tty_struct *tty, -- Gitee From 5acccdd8029d2c5164f0dc91aa0372426965f2bc Mon Sep 17 00:00:00 2001 From: Yi Yang Date: Thu, 15 Aug 2024 14:04:43 +0000 Subject: [PATCH 2/2] tty: vt device use only n_tty ldisc hulk inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IACT4T CVE: CVE-2024-40966 -------------------------------- After backport mainline commit 6bd23e0c2bb6 ("tty: add the option to have a tty reject a new ldisc") Introduced kabi breakage. Fix kabi breakage by check whether it is vt device in tty_set_ldisc(), and check ldisc whether it is N_TTY. Fixes: 6bd23e0c2bb6 ("tty: add the option to have a tty reject a new ldisc") Signed-off-by: Yi Yang --- drivers/tty/tty_ldisc.c | 10 +++++++--- drivers/tty/vt/vt.c | 10 ---------- include/linux/tty_driver.h | 1 - 3 files changed, 7 insertions(+), 14 deletions(-) diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c index dc5267ac9923..94aa39cde22e 100644 --- a/drivers/tty/tty_ldisc.c +++ b/drivers/tty/tty_ldisc.c @@ -579,11 +579,15 @@ int tty_set_ldisc(struct tty_struct *tty, int disc) goto out; } - if (tty->ops->ldisc_ok) { - retval = tty->ops->ldisc_ok(tty, disc); - if (retval) +#ifdef CONFIG_VT + /*vt device use only n_tty ldisc*/ + if (tty->ops->ioctl == vt_ioctl) { + if (disc != N_TTY) { + retval = -EINVAL; goto out; + } } +#endif old_ldisc = tty->ldisc; diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c index 34f3f752f0b2..33fb7b6555f4 100644 --- a/drivers/tty/vt/vt.c +++ b/drivers/tty/vt/vt.c @@ -3448,15 +3448,6 @@ static void con_cleanup(struct tty_struct *tty) tty_port_put(&vc->port); } -/* - * We can't deal with anything but the N_TTY ldisc, - * because we can sleep in our write() routine. - */ -static int con_ldisc_ok(struct tty_struct *tty, int ldisc) -{ - return ldisc == N_TTY ? 0 : -EINVAL; -} - static int default_color = 7; /* white */ static int default_italic_color = 2; // green (ASCII) static int default_underline_color = 3; // cyan (ASCII) @@ -3585,7 +3576,6 @@ static const struct tty_operations con_ops = { .resize = vt_resize, .shutdown = con_shutdown, .cleanup = con_cleanup, - .ldisc_ok = con_ldisc_ok, }; static struct cdev vc0_cdev; diff --git a/include/linux/tty_driver.h b/include/linux/tty_driver.h index c80e82a93577..2f719b471d52 100644 --- a/include/linux/tty_driver.h +++ b/include/linux/tty_driver.h @@ -256,7 +256,6 @@ struct tty_operations { const unsigned char *buf, int count); int (*put_char)(struct tty_struct *tty, unsigned char ch); void (*flush_chars)(struct tty_struct *tty); - int (*ldisc_ok)(struct tty_struct *tty, int ldisc); int (*write_room)(struct tty_struct *tty); int (*chars_in_buffer)(struct tty_struct *tty); int (*ioctl)(struct tty_struct *tty, -- Gitee