Lucid CVE: tty: Make tiocgicount a handler, CVE-2010-4076
Brad Figg
brad.figg at canonical.com
Tue Feb 22 16:23:55 UTC 2011
On 02/17/2011 10:36 AM, Tim Gardner wrote:
> The following changes since commit 40703417f56d44d26fbc45805d91785173ae0ff0:
> Tim Gardner (1):
> UBUNTU: Bump ABI
>
> are available in the git repository at:
>
> git://kernel.ubuntu.com/rtg/ubuntu-lucid.git CVE-2010-4076
>
> Alan Cox (1):
> tty: Make tiocgicount a handler, CVE-2010-4076
>
> drivers/char/tty_io.c | 21 +++++++++++++++++++++
> drivers/serial/serial_core.c | 37 +++++++++++++++++--------------------
> drivers/usb/serial/usb-serial.c | 13 +++++++++++++
> include/linux/tty_driver.h | 9 +++++++++
> include/linux/usb/serial.h | 2 ++
> 5 files changed, 62 insertions(+), 20 deletions(-)
>
> From 0f0d31b311a49011560cb3bae7b2ddafaada312d Mon Sep 17 00:00:00 2001
> From: Alan Cox<alan at linux.intel.com>
> Date: Thu, 16 Sep 2010 18:21:24 +0100
> Subject: [PATCH] tty: Make tiocgicount a handler, CVE-2010-4076
>
> BugLink: http://bugs.launchpad.net/bugs/720189
>
> CVE-2010-4076
>
> Dan Rosenberg noted that various drivers return the struct with uncleared
> fields. Instead of spending forever trying to stomp all the drivers that
> get it wrong (and every new driver) do the job in one place.
>
> This first patch adds the needed operations and hooks them up, including
> the needed USB midlayer and serial core plumbing.
>
> Signed-off-by: Alan Cox<alan at linux.intel.com>
> Signed-off-by: Greg Kroah-Hartman<gregkh at suse.de>
>
> (cherry picked from commit d281da7ff6f70efca0553c288bb883e8605b3862)
>
> Signed-off-by: Tim Gardner<tim.gardner at canonical.com>
> ---
> drivers/char/tty_io.c | 21 +++++++++++++++++++++
> drivers/serial/serial_core.c | 37 +++++++++++++++++--------------------
> drivers/usb/serial/usb-serial.c | 13 +++++++++++++
> include/linux/tty_driver.h | 9 +++++++++
> include/linux/usb/serial.h | 2 ++
> 5 files changed, 62 insertions(+), 20 deletions(-)
>
> diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
> index 53ffcfc..123cedf 100644
> --- a/drivers/char/tty_io.c
> +++ b/drivers/char/tty_io.c
> @@ -96,6 +96,7 @@
> #include<linux/bitops.h>
> #include<linux/delay.h>
> #include<linux/seq_file.h>
> +#include<linux/serial.h>
>
> #include<linux/uaccess.h>
> #include<asm/system.h>
> @@ -2436,6 +2437,20 @@ static int tty_tiocmset(struct tty_struct *tty, struct file *file, unsigned int
> return tty->ops->tiocmset(tty, file, set, clear);
> }
>
> +static int tty_tiocgicount(struct tty_struct *tty, void __user *arg)
> +{
> + int retval = -EINVAL;
> + struct serial_icounter_struct icount;
> + memset(&icount, 0, sizeof(icount));
> + if (tty->ops->get_icount)
> + retval = tty->ops->get_icount(tty,&icount);
> + if (retval != 0)
> + return retval;
> + if (copy_to_user(arg,&icount, sizeof(icount)))
> + return -EFAULT;
> + return 0;
> +}
> +
> struct tty_struct *tty_pair_get_tty(struct tty_struct *tty)
> {
> if (tty->driver->type == TTY_DRIVER_TYPE_PTY&&
> @@ -2556,6 +2571,12 @@ long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
> case TIOCMBIC:
> case TIOCMBIS:
> return tty_tiocmset(tty, file, cmd, p);
> + case TIOCGICOUNT:
> + retval = tty_tiocgicount(tty, p);
> + /* For the moment allow fall through to the old method */
> + if (retval != -EINVAL)
> + return retval;
> + break;
> case TCFLSH:
> switch (arg) {
> case TCIFLUSH:
> diff --git a/drivers/serial/serial_core.c b/drivers/serial/serial_core.c
> index dcc7244..772d9d8 100644
> --- a/drivers/serial/serial_core.c
> +++ b/drivers/serial/serial_core.c
> @@ -1067,10 +1067,10 @@ uart_wait_modem_status(struct uart_state *state, unsigned long arg)
> * NB: both 1->0 and 0->1 transitions are counted except for
> * RI where only 0->1 is counted.
> */
> -static int uart_get_count(struct uart_state *state,
> - struct serial_icounter_struct __user *icnt)
> +static int uart_get_icount(struct tty_struct *tty,
> + struct serial_icounter_struct *icount)
> {
> - struct serial_icounter_struct icount;
> + struct uart_state *state = tty->driver_data;
> struct uart_icount cnow;
> struct uart_port *uport = state->uart_port;
>
> @@ -1078,19 +1078,19 @@ static int uart_get_count(struct uart_state *state,
> memcpy(&cnow,&uport->icount, sizeof(struct uart_icount));
> spin_unlock_irq(&uport->lock);
>
> - icount.cts = cnow.cts;
> - icount.dsr = cnow.dsr;
> - icount.rng = cnow.rng;
> - icount.dcd = cnow.dcd;
> - icount.rx = cnow.rx;
> - icount.tx = cnow.tx;
> - icount.frame = cnow.frame;
> - icount.overrun = cnow.overrun;
> - icount.parity = cnow.parity;
> - icount.brk = cnow.brk;
> - icount.buf_overrun = cnow.buf_overrun;
> + icount->cts = cnow.cts;
> + icount->dsr = cnow.dsr;
> + icount->rng = cnow.rng;
> + icount->dcd = cnow.dcd;
> + icount->rx = cnow.rx;
> + icount->tx = cnow.tx;
> + icount->frame = cnow.frame;
> + icount->overrun = cnow.overrun;
> + icount->parity = cnow.parity;
> + icount->brk = cnow.brk;
> + icount->buf_overrun = cnow.buf_overrun;
>
> - return copy_to_user(icnt,&icount, sizeof(icount)) ? -EFAULT : 0;
> + return 0;
> }
>
> /*
> @@ -1143,10 +1143,6 @@ uart_ioctl(struct tty_struct *tty, struct file *filp, unsigned int cmd,
> case TIOCMIWAIT:
> ret = uart_wait_modem_status(state, arg);
> break;
> -
> - case TIOCGICOUNT:
> - ret = uart_get_count(state, uarg);
> - break;
> }
>
> if (ret != -ENOIOCTLCMD)
> @@ -2322,6 +2318,7 @@ static const struct tty_operations uart_ops = {
> #endif
> .tiocmget = uart_tiocmget,
> .tiocmset = uart_tiocmset,
> + .get_icount = uart_get_icount,
> #ifdef CONFIG_CONSOLE_POLL
> .poll_init = uart_poll_init,
> .poll_get_char = uart_poll_get_char,
> diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
> index bd3fa7f..f23f3b4 100644
> --- a/drivers/usb/serial/usb-serial.c
> +++ b/drivers/usb/serial/usb-serial.c
> @@ -562,6 +562,18 @@ static int serial_tiocmset(struct tty_struct *tty, struct file *file,
> return -EINVAL;
> }
>
> +static int serial_get_icount(struct tty_struct *tty,
> + struct serial_icounter_struct *icount)
> +{
> + struct usb_serial_port *port = tty->driver_data;
> +
> + dbg("%s - port %d", __func__, port->number);
> +
> + if (port->serial->type->get_icount)
> + return port->serial->type->get_icount(tty, icount);
> + return -EINVAL;
> +}
> +
> /*
> * We would be calling tty_wakeup here, but unfortunately some line
> * disciplines have an annoying habit of calling tty->write from
> @@ -1214,6 +1226,7 @@ static const struct tty_operations serial_ops = {
> .chars_in_buffer = serial_chars_in_buffer,
> .tiocmget = serial_tiocmget,
> .tiocmset = serial_tiocmset,
> + .get_icount = serial_get_icount,
> .cleanup = serial_cleanup,
> .install = serial_install,
> .proc_fops = &serial_proc_fops,
> diff --git a/include/linux/tty_driver.h b/include/linux/tty_driver.h
> index b086779..db2d227 100644
> --- a/include/linux/tty_driver.h
> +++ b/include/linux/tty_driver.h
> @@ -224,6 +224,12 @@
> * unless the tty also has a valid tty->termiox pointer.
> *
> * Optional: Called under the termios lock
> + *
> + * int (*get_icount)(struct tty_struct *tty, struct serial_icounter *icount);
> + *
> + * Called when the device receives a TIOCGICOUNT ioctl. Passed a kernel
> + * structure to complete. This method is optional and will only be called
> + * if provided (otherwise EINVAL will be returned).
> */
>
> #include<linux/fs.h>
> @@ -232,6 +238,7 @@
>
> struct tty_struct;
> struct tty_driver;
> +struct serial_icounter_struct;
>
> struct tty_operations {
> struct tty_struct * (*lookup)(struct tty_driver *driver,
> @@ -268,6 +275,8 @@ struct tty_operations {
> unsigned int set, unsigned int clear);
> int (*resize)(struct tty_struct *tty, struct winsize *ws);
> int (*set_termiox)(struct tty_struct *tty, struct termiox *tnew);
> + int (*get_icount)(struct tty_struct *tty,
> + struct serial_icounter_struct *icount);
> #ifdef CONFIG_CONSOLE_POLL
> int (*poll_init)(struct tty_driver *driver, int line, char *options);
> int (*poll_get_char)(struct tty_driver *driver, int line);
> diff --git a/include/linux/usb/serial.h b/include/linux/usb/serial.h
> index ce911eb..7a159e1 100644
> --- a/include/linux/usb/serial.h
> +++ b/include/linux/usb/serial.h
> @@ -259,6 +259,8 @@ struct usb_serial_driver {
> int (*tiocmget)(struct tty_struct *tty, struct file *file);
> int (*tiocmset)(struct tty_struct *tty, struct file *file,
> unsigned int set, unsigned int clear);
> + int (*get_icount)(struct tty_struct *tty,
> + struct serial_icounter_struct *icount);
> /* Called by the tty layer for port level work. There may or may not
> be an attached tty at this point */
> void (*dtr_rts)(struct usb_serial_port *port, int on);
Acked-by: Brad Figg <brad.figg at canonical.com>
--
Brad Figg brad.figg at canonical.com http://www.canonical.com
More information about the kernel-team
mailing list