Dapper CVE: tty: Make tiocgicount a handler, CVE-2010-4076
Tim Gardner
timg at tpi.com
Thu Feb 17 15:58:54 UTC 2011
The following changes since commit 2b4d107cba9ec532e112376537273155825999cf:
Alan Cox (1):
bluetooth: Fix missing NULL check, CVE-2010-4242
are available in the git repository at:
git://kernel.ubuntu.com/rtg/ubuntu-dapper.git CVE-2010-4076
Tim Gardner (1):
tty: Make tiocgicount a handler, CVE-2010-4076
drivers/char/tty_io.c | 18 ++++++++++++++++++
drivers/serial/serial_core.c | 37 +++++++++++++++++--------------------
drivers/usb/serial/usb-serial.c | 13 +++++++++++++
drivers/usb/serial/usb-serial.h | 2 ++
include/linux/tty_driver.h | 11 +++++++++++
5 files changed, 61 insertions(+), 20 deletions(-)
>From bd52ed455730f65da02c7170591065b13b89c3b4 Mon Sep 17 00:00:00 2001
From: Tim Gardner <tim.gardner at canonical.com>
Date: Wed, 16 Feb 2011 13:09:41 -0700
Subject: [PATCH] tty: Make tiocgicount a handler, CVE-2010-4076
BugLink: http://bugs.launchpad.net/bugs/720189
CVE-2010-4076
Dan Rosenberg noted that various drivers return the struct with uncleared
fields. Instead of spending forever trying to stomp all the drivers that
get it wrong (and every new driver) do the job in one place.
This first patch adds the needed operations and hooks them up, including
the needed USB midlayer and serial core plumbing.
Signed-off-by: Alan Cox <alan at linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
(backported from commit d281da7ff6f70efca0553c288bb883e8605b3862)
Signed-off-by: Tim Gardner <tim.gardner at canonical.com>
---
drivers/char/tty_io.c | 18 ++++++++++++++++++
drivers/serial/serial_core.c | 37 +++++++++++++++++--------------------
drivers/usb/serial/usb-serial.c | 13 +++++++++++++
drivers/usb/serial/usb-serial.h | 2 ++
include/linux/tty_driver.h | 11 +++++++++++
5 files changed, 61 insertions(+), 20 deletions(-)
diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index 4b1eef5..667db03 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -95,6 +95,7 @@
#include <linux/wait.h>
#include <linux/bitops.h>
#include <linux/delay.h>
+#include <linux/serial.h>
#include <asm/uaccess.h>
#include <asm/system.h>
@@ -2267,6 +2268,20 @@ tty_tiocmset(struct tty_struct *tty, struct file *file, unsigned int cmd,
return retval;
}
+static int tty_tiocgicount(struct tty_struct *tty, void __user *arg)
+{
+ int retval = -EINVAL;
+ struct serial_icounter_struct icount;
+ memset(&icount, 0, sizeof(icount));
+ if (tty->driver->get_icount)
+ retval = tty->driver->get_icount(tty, &icount);
+ if (retval != 0)
+ return retval;
+ if (copy_to_user(arg, &icount, sizeof(icount)))
+ return -EFAULT;
+ return 0;
+}
+
/*
* Split this up, as gcc can choke on it otherwise..
*/
@@ -2403,6 +2418,8 @@ int tty_ioctl(struct inode * inode, struct file * file,
case TIOCMBIC:
case TIOCMBIS:
return tty_tiocmset(tty, file, cmd, p);
+ case TIOCGICOUNT:
+ return tty_tiocgicount(tty, p);
}
if (tty->driver->ioctl) {
retval = (tty->driver->ioctl)(tty, file, cmd, arg);
@@ -2789,6 +2806,7 @@ void tty_set_operations(struct tty_driver *driver, struct tty_operations *op)
driver->write_proc = op->write_proc;
driver->tiocmget = op->tiocmget;
driver->tiocmset = op->tiocmset;
+ driver->get_icount = op->get_icount;
}
diff --git a/drivers/serial/serial_core.c b/drivers/serial/serial_core.c
index e159b32..365374f 100644
--- a/drivers/serial/serial_core.c
+++ b/drivers/serial/serial_core.c
@@ -988,10 +988,10 @@ uart_wait_modem_status(struct uart_state *state, unsigned long arg)
* NB: both 1->0 and 0->1 transitions are counted except for
* RI where only 0->1 is counted.
*/
-static int uart_get_count(struct uart_state *state,
- struct serial_icounter_struct __user *icnt)
+static int uart_get_icount(struct tty_struct *tty,
+ struct serial_icounter_struct *icount)
{
- struct serial_icounter_struct icount;
+ struct uart_state *state = tty->driver_data;
struct uart_icount cnow;
struct uart_port *port = state->port;
@@ -999,19 +999,19 @@ static int uart_get_count(struct uart_state *state,
memcpy(&cnow, &port->icount, sizeof(struct uart_icount));
spin_unlock_irq(&port->lock);
- icount.cts = cnow.cts;
- icount.dsr = cnow.dsr;
- icount.rng = cnow.rng;
- icount.dcd = cnow.dcd;
- icount.rx = cnow.rx;
- icount.tx = cnow.tx;
- icount.frame = cnow.frame;
- icount.overrun = cnow.overrun;
- icount.parity = cnow.parity;
- icount.brk = cnow.brk;
- icount.buf_overrun = cnow.buf_overrun;
-
- return copy_to_user(icnt, &icount, sizeof(icount)) ? -EFAULT : 0;
+ icount->cts = cnow.cts;
+ icount->dsr = cnow.dsr;
+ icount->rng = cnow.rng;
+ icount->dcd = cnow.dcd;
+ icount->rx = cnow.rx;
+ icount->tx = cnow.tx;
+ icount->frame = cnow.frame;
+ icount->overrun = cnow.overrun;
+ icount->parity = cnow.parity;
+ icount->brk = cnow.brk;
+ icount->buf_overrun = cnow.buf_overrun;
+
+ return 0;
}
/*
@@ -1064,10 +1064,6 @@ uart_ioctl(struct tty_struct *tty, struct file *filp, unsigned int cmd,
case TIOCMIWAIT:
ret = uart_wait_modem_status(state, arg);
break;
-
- case TIOCGICOUNT:
- ret = uart_get_count(state, uarg);
- break;
}
if (ret != -ENOIOCTLCMD)
@@ -2107,6 +2103,7 @@ static struct tty_operations uart_ops = {
#endif
.tiocmget = uart_tiocmget,
.tiocmset = uart_tiocmset,
+ .get_icount = uart_get_icount,
};
/**
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index 0ed6790..c77eb4d 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -481,6 +481,18 @@ exit:
return -EINVAL;
}
+static int serial_get_icount(struct tty_struct *tty,
+ struct serial_icounter_struct *icount)
+{
+ struct usb_serial_port *port = tty->driver_data;
+
+ dbg("%s - port %d", __func__, port->number);
+
+ if (port->serial->type->get_icount)
+ return port->serial->type->get_icount(tty, icount);
+ return -EINVAL;
+}
+
void usb_serial_port_softint(void *private)
{
struct usb_serial_port *port = private;
@@ -978,6 +990,7 @@ static struct tty_operations serial_ops = {
.read_proc = serial_read_proc,
.tiocmget = serial_tiocmget,
.tiocmset = serial_tiocmset,
+ .get_icount = serial_get_icount,
};
struct tty_driver *usb_serial_tty_driver;
diff --git a/drivers/usb/serial/usb-serial.h b/drivers/usb/serial/usb-serial.h
index fbf526e..36711c2 100644
--- a/drivers/usb/serial/usb-serial.h
+++ b/drivers/usb/serial/usb-serial.h
@@ -226,6 +226,8 @@ struct usb_serial_driver {
void (*unthrottle) (struct usb_serial_port *port);
int (*tiocmget) (struct usb_serial_port *port, struct file *file);
int (*tiocmset) (struct usb_serial_port *port, struct file *file, unsigned int set, unsigned int clear);
+ int (*get_icount)(struct tty_struct *tty,
+ struct serial_icounter_struct *icount);
void (*read_int_callback)(struct urb *urb, struct pt_regs *regs);
void (*write_int_callback)(struct urb *urb, struct pt_regs *regs);
diff --git a/include/linux/tty_driver.h b/include/linux/tty_driver.h
index b368b29..fb4c81c 100644
--- a/include/linux/tty_driver.h
+++ b/include/linux/tty_driver.h
@@ -113,11 +113,18 @@
*
* This routine is used to send a high-priority XON/XOFF
* character to the device.
+ *
+ * int (*get_icount)(struct tty_struct *tty, struct serial_icounter *icount);
+ *
+ * Called when the device receives a TIOCGICOUNT ioctl. Passed a kernel
+ * structure to complete. This method is optional and will only be called
+ * if provided (otherwise EINVAL will be returned).
*/
#include <linux/fs.h>
#include <linux/list.h>
#include <linux/cdev.h>
+#include <linux/serial.h> /* for serial_state and serial_icounter_struct */
struct tty_struct;
@@ -150,6 +157,8 @@ struct tty_operations {
int (*tiocmget)(struct tty_struct *tty, struct file *file);
int (*tiocmset)(struct tty_struct *tty, struct file *file,
unsigned int set, unsigned int clear);
+ int (*get_icount)(struct tty_struct *tty,
+ struct serial_icounter_struct *icount);
};
struct tty_driver {
@@ -212,6 +221,8 @@ struct tty_driver {
int (*tiocmget)(struct tty_struct *tty, struct file *file);
int (*tiocmset)(struct tty_struct *tty, struct file *file,
unsigned int set, unsigned int clear);
+ int (*get_icount)(struct tty_struct *tty,
+ struct serial_icounter_struct *icount);
struct list_head tty_drivers;
};
--
1.7.0.4
More information about the kernel-team
mailing list