qiurui
/
Centos-kernel-stream-9
mirror of https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

tty: n_gsm: Fix use-after-free in gsm_cleanup_mux 

JIRA: https://issues.redhat.com/browse/RHEL-65117
CVE: CVE-2024-50073

commit 9462f4ca56e7d2430fdb6dcc8498244acbfc4489
Author: Longlong Xia <xialonglong@kylinos.cn>
Date:   Thu Sep 26 21:02:13 2024 +0800

    tty: n_gsm: Fix use-after-free in gsm_cleanup_mux

    BUG: KASAN: slab-use-after-free in gsm_cleanup_mux+0x77b/0x7b0
    drivers/tty/n_gsm.c:3160 [n_gsm]
    Read of size 8 at addr ffff88815fe99c00 by task poc/3379
    CPU: 0 UID: 0 PID: 3379 Comm: poc Not tainted 6.11.0+ #56
    Hardware name: VMware, Inc. VMware Virtual Platform/440BX
    Desktop Reference Platform, BIOS 6.00 11/12/2020
    Call Trace:
     <TASK>
     gsm_cleanup_mux+0x77b/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm]
     __pfx_gsm_cleanup_mux+0x10/0x10 drivers/tty/n_gsm.c:3124 [n_gsm]
     __pfx_sched_clock_cpu+0x10/0x10 kernel/sched/clock.c:389
     update_load_avg+0x1c1/0x27b0 kernel/sched/fair.c:4500
     __pfx_min_vruntime_cb_rotate+0x10/0x10 kernel/sched/fair.c:846
     __rb_insert_augmented+0x492/0xbf0 lib/rbtree.c:161
     gsmld_ioctl+0x395/0x1450 drivers/tty/n_gsm.c:3408 [n_gsm]
     _raw_spin_lock_irqsave+0x92/0xf0 arch/x86/include/asm/atomic.h:107
     __pfx_gsmld_ioctl+0x10/0x10 drivers/tty/n_gsm.c:3822 [n_gsm]
     ktime_get+0x5e/0x140 kernel/time/timekeeping.c:195
     ldsem_down_read+0x94/0x4e0 arch/x86/include/asm/atomic64_64.h:79
     __pfx_ldsem_down_read+0x10/0x10 drivers/tty/tty_ldsem.c:338
     __pfx_do_vfs_ioctl+0x10/0x10 fs/ioctl.c:805
     tty_ioctl+0x643/0x1100 drivers/tty/tty_io.c:2818

    Allocated by task 65:
     gsm_data_alloc.constprop.0+0x27/0x190 drivers/tty/n_gsm.c:926 [n_gsm]
     gsm_send+0x2c/0x580 drivers/tty/n_gsm.c:819 [n_gsm]
     gsm1_receive+0x547/0xad0 drivers/tty/n_gsm.c:3038 [n_gsm]
     gsmld_receive_buf+0x176/0x280 drivers/tty/n_gsm.c:3609 [n_gsm]
     tty_ldisc_receive_buf+0x101/0x1e0 drivers/tty/tty_buffer.c:391
     tty_port_default_receive_buf+0x61/0xa0 drivers/tty/tty_port.c:39
     flush_to_ldisc+0x1b0/0x750 drivers/tty/tty_buffer.c:445
     process_scheduled_works+0x2b0/0x10d0 kernel/workqueue.c:3229
     worker_thread+0x3dc/0x950 kernel/workqueue.c:3391
     kthread+0x2a3/0x370 kernel/kthread.c:389
     ret_from_fork+0x2d/0x70 arch/x86/kernel/process.c:147
     ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:257

    Freed by task 3367:
     kfree+0x126/0x420 mm/slub.c:4580
     gsm_cleanup_mux+0x36c/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm]
     gsmld_ioctl+0x395/0x1450 drivers/tty/n_gsm.c:3408 [n_gsm]
     tty_ioctl+0x643/0x1100 drivers/tty/tty_io.c:2818

    [Analysis]
    gsm_msg on the tx_ctrl_list or tx_data_list of gsm_mux
    can be freed by multi threads through ioctl,which leads
    to the occurrence of uaf. Protect it by gsm tx lock.

    Signed-off-by: Longlong Xia <xialonglong@kylinos.cn>
    Cc: stable <stable@kernel.org>
    Suggested-by: Jiri Slaby <jirislaby@kernel.org>
    Link: https://lore.kernel.org/r/20240926130213.531959-1-xialonglong@kylinos.cn
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com>
This commit is contained in:
CKI Backport Bot 2024-10-29 07:42:27 +00:00
parent a80054fe2d
commit 725b86e183
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/tty/n_gsm.c
View File

@ -3106,6 +3106,8 @@ static void gsm_cleanup_mux(struct gsm_mux *gsm, bool disc)
mutex_unlock(&gsm->mutex);
/* Now wipe the queues */
tty_ldisc_flush(gsm->tty);
guard(spinlock_irqsave)(&gsm->tx_lock);
list_for_each_entry_safe(txq, ntxq, &gsm->tx_ctrl_list, list)
kfree(txq);
INIT_LIST_HEAD(&gsm->tx_ctrl_list);