• Peter Hurley's avatar
    net: irda: Fix use-after-free in irtty_open() · 401879c5
    Peter Hurley authored
    The N_IRDA line discipline may access the previous line discipline's closed
    and already-fre private data on open [1].
    
    The tty->disc_data field _never_ refers to valid data on entry to the
    line discipline's open() method. Rather, the ldisc is expected to
    initialize that field for its own use for the lifetime of the instance
    (ie. from open() to close() only).
    
    [1]
        ==================================================================
        BUG: KASAN: use-after-free in irtty_open+0x422/0x550 at addr ffff8800331dd068
        Read of size 4 by task a.out/13960
        =============================================================================
        BUG kmalloc-512 (Tainted: G    B          ): kasan: bad access detected
        -----------------------------------------------------------------------------
        ...
        Call Trace:
         [<ffffffff815fa2ae>] __asan_report_load4_noabort+0x3e/0x40 mm/kasan/report.c:279
         [<ffffffff836938a2>] irtty_open+0x422/0x550 drivers/net/irda/irtty-sir.c:436
         [<ffffffff829f1b80>] tty_ldisc_open.isra.2+0x60/0xa0 drivers/tty/tty_ldisc.c:447
         [<ffffffff829f21c0>] tty_set_ldisc+0x1a0/0x940 drivers/tty/tty_ldisc.c:567
         [<     inline     >] tiocsetd drivers/tty/tty_io.c:2650
         [<ffffffff829da49e>] tty_ioctl+0xace/0x1fd0 drivers/tty/tty_io.c:2883
         [<     inline     >] vfs_ioctl fs/ioctl.c:43
         [<ffffffff816708ac>] do_vfs_ioctl+0x57c/0xe60 fs/ioctl.c:607
         [<     inline     >] SYSC_ioctl fs/ioctl.c:622
         [<ffffffff81671204>] SyS_ioctl+0x74/0x80 fs/ioctl.c:613
         [<ffffffff852a7876>] entry_SYSCALL_64_fastpath+0x16/0x7a
    Reported-and-tested-by: default avatarDmitry Vyukov <dvyukov@google.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: default avatarPeter Hurley <peter@hurleysoftware.com>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    401879c5
irtty-sir.c 14.2 KB