From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Miles Chen <miles.chen@mediatek.com>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH 4.9 02/83] tty: check name length in tty_find_polling_driver()
Date: Mon, 19 Nov 2018 17:28:28 +0100 [thread overview]
Message-ID: <20181119162612.466666532@linuxfoundation.org> (raw)
In-Reply-To: <20181119162612.046511542@linuxfoundation.org>
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miles Chen <miles.chen@mediatek.com>
[ Upstream commit 33a1a7be198657c8ca26ad406c4d2a89b7162bcc ]
The issue is found by a fuzzing test.
If tty_find_polling_driver() recevies an incorrect input such as
',,' or '0b', the len becomes 0 and strncmp() always return 0.
In this case, a null p->ops->poll_init() is called and it causes a kernel
panic.
Fix this by checking name length against zero in tty_find_polling_driver().
$echo ,, > /sys/module/kgdboc/parameters/kgdboc
[ 20.804451] WARNING: CPU: 1 PID: 104 at drivers/tty/serial/serial_core.c:457
uart_get_baud_rate+0xe8/0x190
[ 20.804917] Modules linked in:
[ 20.805317] CPU: 1 PID: 104 Comm: sh Not tainted 4.19.0-rc7ajb #8
[ 20.805469] Hardware name: linux,dummy-virt (DT)
[ 20.805732] pstate: 20000005 (nzCv daif -PAN -UAO)
[ 20.805895] pc : uart_get_baud_rate+0xe8/0x190
[ 20.806042] lr : uart_get_baud_rate+0xc0/0x190
[ 20.806476] sp : ffffffc06acff940
[ 20.806676] x29: ffffffc06acff940 x28: 0000000000002580
[ 20.806977] x27: 0000000000009600 x26: 0000000000009600
[ 20.807231] x25: ffffffc06acffad0 x24: 00000000ffffeff0
[ 20.807576] x23: 0000000000000001 x22: 0000000000000000
[ 20.807807] x21: 0000000000000001 x20: 0000000000000000
[ 20.808049] x19: ffffffc06acffac8 x18: 0000000000000000
[ 20.808277] x17: 0000000000000000 x16: 0000000000000000
[ 20.808520] x15: ffffffffffffffff x14: ffffffff00000000
[ 20.808757] x13: ffffffffffffffff x12: 0000000000000001
[ 20.809011] x11: 0101010101010101 x10: ffffff880d59ff5f
[ 20.809292] x9 : ffffff880d59ff5e x8 : ffffffc06acffaf3
[ 20.809549] x7 : 0000000000000000 x6 : ffffff880d59ff5f
[ 20.809803] x5 : 0000000080008001 x4 : 0000000000000003
[ 20.810056] x3 : ffffff900853e6b4 x2 : dfffff9000000000
[ 20.810693] x1 : ffffffc06acffad0 x0 : 0000000000000cb0
[ 20.811005] Call trace:
[ 20.811214] uart_get_baud_rate+0xe8/0x190
[ 20.811479] serial8250_do_set_termios+0xe0/0x6f4
[ 20.811719] serial8250_set_termios+0x48/0x54
[ 20.811928] uart_set_options+0x138/0x1bc
[ 20.812129] uart_poll_init+0x114/0x16c
[ 20.812330] tty_find_polling_driver+0x158/0x200
[ 20.812545] configure_kgdboc+0xbc/0x1bc
[ 20.812745] param_set_kgdboc_var+0xb8/0x150
[ 20.812960] param_attr_store+0xbc/0x150
[ 20.813160] module_attr_store+0x40/0x58
[ 20.813364] sysfs_kf_write+0x8c/0xa8
[ 20.813563] kernfs_fop_write+0x154/0x290
[ 20.813764] vfs_write+0xf0/0x278
[ 20.813951] __arm64_sys_write+0x84/0xf4
[ 20.814400] el0_svc_common+0xf4/0x1dc
[ 20.814616] el0_svc_handler+0x98/0xbc
[ 20.814804] el0_svc+0x8/0xc
[ 20.822005] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
[ 20.826913] Mem abort info:
[ 20.827103] ESR = 0x84000006
[ 20.827352] Exception class = IABT (current EL), IL = 16 bits
[ 20.827655] SET = 0, FnV = 0
[ 20.827855] EA = 0, S1PTW = 0
[ 20.828135] user pgtable: 4k pages, 39-bit VAs, pgdp = (____ptrval____)
[ 20.828484] [0000000000000000] pgd=00000000aadee003, pud=00000000aadee003, pmd=0000000000000000
[ 20.829195] Internal error: Oops: 84000006 [#1] SMP
[ 20.829564] Modules linked in:
[ 20.829890] CPU: 1 PID: 104 Comm: sh Tainted: G W 4.19.0-rc7ajb #8
[ 20.830545] Hardware name: linux,dummy-virt (DT)
[ 20.830829] pstate: 60000085 (nZCv daIf -PAN -UAO)
[ 20.831174] pc : (null)
[ 20.831457] lr : serial8250_do_set_termios+0x358/0x6f4
[ 20.831727] sp : ffffffc06acff9b0
[ 20.831936] x29: ffffffc06acff9b0 x28: ffffff9008d7c000
[ 20.832267] x27: ffffff900969e16f x26: 0000000000000000
[ 20.832589] x25: ffffff900969dfb0 x24: 0000000000000000
[ 20.832906] x23: ffffffc06acffad0 x22: ffffff900969e160
[ 20.833232] x21: 0000000000000000 x20: ffffffc06acffac8
[ 20.833559] x19: ffffff900969df90 x18: 0000000000000000
[ 20.833878] x17: 0000000000000000 x16: 0000000000000000
[ 20.834491] x15: ffffffffffffffff x14: ffffffff00000000
[ 20.834821] x13: ffffffffffffffff x12: 0000000000000001
[ 20.835143] x11: 0101010101010101 x10: ffffff880d59ff5f
[ 20.835467] x9 : ffffff880d59ff5e x8 : ffffffc06acffaf3
[ 20.835790] x7 : 0000000000000000 x6 : ffffff880d59ff5f
[ 20.836111] x5 : c06419717c314100 x4 : 0000000000000007
[ 20.836419] x3 : 0000000000000000 x2 : 0000000000000000
[ 20.836732] x1 : 0000000000000001 x0 : ffffff900969df90
[ 20.837100] Process sh (pid: 104, stack limit = 0x(____ptrval____))
[ 20.837396] Call trace:
[ 20.837566] (null)
[ 20.837816] serial8250_set_termios+0x48/0x54
[ 20.838089] uart_set_options+0x138/0x1bc
[ 20.838570] uart_poll_init+0x114/0x16c
[ 20.838834] tty_find_polling_driver+0x158/0x200
[ 20.839119] configure_kgdboc+0xbc/0x1bc
[ 20.839380] param_set_kgdboc_var+0xb8/0x150
[ 20.839658] param_attr_store+0xbc/0x150
[ 20.839920] module_attr_store+0x40/0x58
[ 20.840183] sysfs_kf_write+0x8c/0xa8
[ 20.840183] sysfs_kf_write+0x8c/0xa8
[ 20.840440] kernfs_fop_write+0x154/0x290
[ 20.840702] vfs_write+0xf0/0x278
[ 20.840942] __arm64_sys_write+0x84/0xf4
[ 20.841209] el0_svc_common+0xf4/0x1dc
[ 20.841471] el0_svc_handler+0x98/0xbc
[ 20.841713] el0_svc+0x8/0xc
[ 20.842057] Code: bad PC value
[ 20.842764] ---[ end trace a8835d7de79aaadf ]---
[ 20.843134] Kernel panic - not syncing: Fatal exception
[ 20.843515] SMP: stopping secondary CPUs
[ 20.844289] Kernel Offset: disabled
[ 20.844634] CPU features: 0x0,21806002
[ 20.844857] Memory Limit: none
[ 20.845172] ---[ end Kernel panic - not syncing: Fatal exception ]---
Signed-off-by: Miles Chen <miles.chen@mediatek.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/tty_io.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -354,7 +354,7 @@ struct tty_driver *tty_find_polling_driv
mutex_lock(&tty_mutex);
/* Search through the tty devices to look for a match */
list_for_each_entry(p, &tty_drivers, tty_drivers) {
- if (strncmp(name, p->name, len) != 0)
+ if (!len || strncmp(name, p->name, len) != 0)
continue;
stp = str;
if (*stp == ',')
next prev parent reply other threads:[~2018-11-19 16:28 UTC|newest]
Thread overview: 89+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-11-19 16:28 [PATCH 4.9 00/83] 4.9.138-stable review Greg Kroah-Hartman
2018-11-19 16:28 ` [PATCH 4.9 01/83] powerpc/eeh: Fix possible null deref in eeh_dump_dev_log() Greg Kroah-Hartman
2018-11-19 16:28 ` Greg Kroah-Hartman [this message]
2018-11-19 16:28 ` [PATCH 4.9 03/83] ARM: imx_v6_v7_defconfig: Select CONFIG_TMPFS_POSIX_ACL Greg Kroah-Hartman
2018-11-19 16:28 ` [PATCH 4.9 04/83] powerpc/nohash: fix undefined behaviour when testing page size support Greg Kroah-Hartman
2018-11-19 16:28 ` [PATCH 4.9 05/83] drm/omap: fix memory barrier bug in DMM driver Greg Kroah-Hartman
2018-11-19 16:28 ` [PATCH 4.9 06/83] media: pci: cx23885: handle adding to list failure Greg Kroah-Hartman
2018-11-19 16:28 ` [PATCH 4.9 07/83] MIPS: kexec: Mark CPU offline before disabling local IRQ Greg Kroah-Hartman
2018-11-19 16:28 ` [PATCH 4.9 08/83] powerpc/boot: Ensure _zimage_start is a weak symbol Greg Kroah-Hartman
2018-11-19 16:28 ` [PATCH 4.9 09/83] MIPS/PCI: Call pcie_bus_configure_settings() to set MPS/MRRS Greg Kroah-Hartman
2018-11-19 16:28 ` [PATCH 4.9 10/83] sc16is7xx: Fix for multi-channel stall Greg Kroah-Hartman
2018-11-19 16:28 ` [PATCH 4.9 11/83] media: tvp5150: fix width alignment during set_selection() Greg Kroah-Hartman
2018-11-19 16:28 ` [PATCH 4.9 12/83] powerpc/selftests: Wait all threads to join Greg Kroah-Hartman
2018-11-19 16:28 ` [PATCH 4.9 13/83] 9p locks: fix glock.client_id leak in do_lock Greg Kroah-Hartman
2018-11-19 16:28 ` [PATCH 4.9 14/83] 9p: clear dangling pointers in p9stat_free Greg Kroah-Hartman
2018-11-19 16:28 ` [PATCH 4.9 15/83] cdrom: fix improper type cast, which can leat to information leak Greg Kroah-Hartman
2018-11-19 16:28 ` [PATCH 4.9 16/83] scsi: qla2xxx: Fix incorrect port speed being set for FC adapters Greg Kroah-Hartman
2018-11-19 16:28 ` [PATCH 4.9 17/83] scsi: qla2xxx: shutdown chip if reset fail Greg Kroah-Hartman
2018-11-19 16:28 ` [PATCH 4.9 18/83] fuse: Fix use-after-free in fuse_dev_do_read() Greg Kroah-Hartman
2018-11-19 16:28 ` [PATCH 4.9 19/83] fuse: Fix use-after-free in fuse_dev_do_write() Greg Kroah-Hartman
2018-11-19 16:28 ` [PATCH 4.9 20/83] fuse: fix blocked_waitq wakeup Greg Kroah-Hartman
2018-11-19 16:28 ` [PATCH 4.9 21/83] fuse: set FR_SENT while locked Greg Kroah-Hartman
2018-11-19 16:28 ` [PATCH 4.9 22/83] mm: do not bug_on on incorrect length in __mm_populate() Greg Kroah-Hartman
2018-11-19 16:28 ` [PATCH 4.9 23/83] e1000: avoid null pointer dereference on invalid stat type Greg Kroah-Hartman
2018-11-19 16:28 ` [PATCH 4.9 24/83] e1000: fix race condition between e1000_down() and e1000_watchdog Greg Kroah-Hartman
2018-11-19 16:28 ` [PATCH 4.9 25/83] bna: ethtool: Avoid reading past end of buffer Greg Kroah-Hartman
2018-11-19 16:28 ` [PATCH 4.9 26/83] parisc: Align os_hpmc_size on word boundary Greg Kroah-Hartman
2018-11-19 16:28 ` [PATCH 4.9 27/83] parisc: Fix HPMC handler by increasing size to multiple of 16 bytes Greg Kroah-Hartman
2018-11-19 16:28 ` [PATCH 4.9 28/83] parisc: Fix exported address of os_hpmc handler Greg Kroah-Hartman
2018-11-19 16:28 ` [PATCH 4.9 29/83] MIPS: Loongson-3: Fix CPU UART irq delivery problem Greg Kroah-Hartman
2018-11-19 16:28 ` [PATCH 4.9 30/83] MIPS: Loongson-3: Fix BRIDGE " Greg Kroah-Hartman
2018-11-19 16:28 ` [PATCH 4.9 31/83] xtensa: add NOTES section to the linker script Greg Kroah-Hartman
2018-11-19 16:28 ` [PATCH 4.9 32/83] xtensa: make sure bFLT stack is 16 byte aligned Greg Kroah-Hartman
2018-11-19 16:28 ` [PATCH 4.9 33/83] xtensa: fix boot parameters address translation Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 34/83] clk: s2mps11: Fix matching when built as module and DT node contains compatible Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 35/83] clk: at91: Fix division by zero in PLL recalc_rate() Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 36/83] clk: rockchip: Fix static checker warning in rockchip_ddrclk_get_parent call Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 37/83] libceph: bump CEPH_MSG_MAX_DATA_LEN Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 38/83] Revert "ceph: fix dentry leak in splice_dentry()" Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 39/83] mach64: fix display corruption on big endian machines Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 40/83] mach64: fix image corruption due to reading accelerator registers Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 41/83] reset: hisilicon: fix potential NULL pointer dereference Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 42/83] vhost/scsi: truncate T10 PI iov_iter to prot_bytes Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 43/83] ocfs2: fix a misuse a of brelse after failing ocfs2_check_dir_entry Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 44/83] mm: thp: relax __GFP_THISNODE for MADV_HUGEPAGE mappings Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 45/83] netfilter: conntrack: fix calculation of next bucket number in early_drop Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 46/83] mtd: docg3: dont set conflicting BCH_CONST_PARAMS option Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 47/83] of, numa: Validate some distance map rules Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 48/83] termios, tty/tty_baudrate.c: fix buffer overrun Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 49/83] arch/alpha, termios: implement BOTHER, IBSHIFT and termios2 Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 50/83] Btrfs: fix cur_offset in the error case for nocow Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 51/83] Btrfs: fix data corruption due to cloning of eof block Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 52/83] clockevents/drivers/i8253: Add support for PIT shutdown quirk Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 53/83] ext4: add missing brelse() update_backups()s error path Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 54/83] ext4: add missing brelse() in set_flexbg_block_bitmap()s " Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 55/83] ext4: add missing brelse() add_new_gdb_meta_bg()s " Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 56/83] ext4: avoid potential extra brelse in setup_new_flex_group_blocks() Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 57/83] ext4: fix possible inode leak in the retry loop of ext4_resize_fs() Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 58/83] ext4: avoid buffer leak in ext4_orphan_add() after prior errors Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 59/83] ext4: fix missing cleanup if ext4_alloc_flex_bg_array() fails while resizing Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 60/83] ext4: avoid possible double brelse() in add_new_gdb() on error path Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 61/83] ext4: fix possible leak of sbi->s_group_desc_leak in " Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 62/83] ext4: fix possible leak of s_journal_flag_rwsem " Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 63/83] ext4: release bs.bh before re-using in ext4_xattr_block_find() Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 64/83] ext4: fix buffer leak in ext4_xattr_move_to_block() on error path Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 65/83] ext4: fix buffer leak in __ext4_read_dirblock() " Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 66/83] mount: Retest MNT_LOCKED in do_umount Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 67/83] mount: Dont allow copying MNT_UNBINDABLE|MNT_LOCKED mounts Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 68/83] mount: Prevent MNT_DETACH from disconnecting locked mounts Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 69/83] sunrpc: correct the computation for page_ptr when truncating Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 70/83] nfsd: COPY and CLONE operations require the saved filehandle to be set Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 71/83] rtc: hctosys: Add missing range error reporting Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 72/83] fuse: fix use-after-free in fuse_direct_IO() Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 73/83] fuse: fix leaked notify reply Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 74/83] configfs: replace strncpy with memcpy Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 75/83] lib/ubsan.c: dont mark __ubsan_handle_builtin_unreachable as noreturn Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 76/83] hugetlbfs: fix kernel BUG at fs/hugetlbfs/inode.c:444! Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 77/83] mm: migration: fix migration of huge PMD shared pages Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 78/83] drm/rockchip: Allow driver to be shutdown on reboot/kexec Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 79/83] drm/dp_mst: Check if primary mstb is null Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 80/83] drm/i915/hdmi: Add HDMI 2.0 audio clock recovery N values Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 81/83] drm/i915/execlists: Force write serialisation into context image vs execution Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 82/83] KVM: arm64: Fix caching of host MDCR_EL2 value Greg Kroah-Hartman
2018-11-19 16:29 ` [PATCH 4.9 83/83] ovl: check whiteout in ovl_create_over_whiteout() Greg Kroah-Hartman
2018-11-19 23:31 ` [PATCH 4.9 00/83] 4.9.138-stable review kernelci.org bot
2018-11-20 0:16 ` shuah
2018-11-20 8:11 ` Naresh Kamboju
2018-11-20 10:54 ` Jon Hunter
2018-11-20 20:39 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181119162612.466666532@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=miles.chen@mediatek.com \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).