ACK: [PATCH] speakup: Reject setting the speakup line discipline outside of speakup

[Stefan Bader]

On 05.03.21 21:58, Tim Gardner wrote:
> From: Samuel Thibault <samuel.thibault at ens-lyon.org>
> 
> CVE-2020-27830
> 
> commit f0992098cadb4c9c6a00703b66cafe604e178fea upstream.
> 
> Speakup exposing a line discipline allows userland to try to use it,
> while it is deemed to be useless, and thus uselessly exposes potential
> bugs. One of them is simply that in such a case if the line sends data,
> spk_ttyio_receive_buf2 is called and crashes since spk_ttyio_synth
> is NULL.
> 
> This change restricts the use of the speakup line discipline to
> speakup drivers, thus avoiding such kind of issues altogether.
> 
> Cc: stable at vger.kernel.org
> Reported-by: Shisong Qin <qinshisong1205 at gmail.com>
> Signed-off-by: Samuel Thibault <samuel.thibault at ens-lyon.org>
> Tested-by: Shisong Qin <qinshisong1205 at gmail.com>
> Link: https://lore.kernel.org/r/20201129193523.hm3f6n5xrn6fiyyc@function
> Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
> 
> (backported from commit b0d4fa10bfcc3051e9426b6286fb2d80bad04d74 linux-5.4.y)
> Signed-off-by: Tim Gardner <tim.gardner at canonical.com>
Acked-by: Stefan Bader <stefan.bader at canonical.com>
> 
> ---
> The 5.4.y backport was closest in heritage to v5.6 when the driver was still in staging.
> 
> Conflicts:
> 	drivers/staging/speakup/spk_ttyio.c
> 
> Adjusted some context. The stable patch also removed a superfluous statement which makes sense
> when you look at the code:
> 	speakup_tty = tty;
> 
>   drivers/staging/speakup/spk_ttyio.c | 25 ++++++++++++++++++++++---
>   1 file changed, 22 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/staging/speakup/spk_ttyio.c b/drivers/staging/speakup/spk_ttyio.c
> index 5a9eff08cb96..472804c3f44d 100644
> --- a/drivers/staging/speakup/spk_ttyio.c
> +++ b/drivers/staging/speakup/spk_ttyio.c
> @@ -47,9 +47,12 @@ static int spk_ttyio_ldisc_open(struct tty_struct *tty)
>   {
>   	struct spk_ldisc_data *ldisc_data;
>   
> +	if (tty != speakup_tty)
> +		/* Somebody tried to use this line discipline outside speakup */
> +		return -ENODEV;
> +
>   	if (!tty->ops->write)
>   		return -EOPNOTSUPP;
> -	speakup_tty = tty;
>   
>   	ldisc_data = kmalloc(sizeof(struct spk_ldisc_data), GFP_KERNEL);
>   	if (!ldisc_data)
> @@ -57,7 +60,7 @@ static int spk_ttyio_ldisc_open(struct tty_struct *tty)
>   
>   	init_completion(&ldisc_data->completion);
>   	ldisc_data->buf_free = true;
> -	speakup_tty->disc_data = ldisc_data;
> +	tty->disc_data = ldisc_data;
>   
>   	return 0;
>   }
> @@ -179,9 +182,25 @@ static int spk_ttyio_initialise_ldisc(struct spk_synth *synth)
>   
>   	tty_unlock(tty);
>   
> +	mutex_lock(&speakup_tty_mutex);
> +	speakup_tty = tty;
>   	ret = tty_set_ldisc(tty, N_SPEAKUP);
>   	if (ret)
> -		pr_err("speakup: Failed to set N_SPEAKUP on tty\n");
> +		speakup_tty = NULL;
> +	mutex_unlock(&speakup_tty_mutex);
> +
> +	if (!ret)
> +		/* Success */
> +		return 0;
> +
> +	pr_err("speakup: Failed to set N_SPEAKUP on tty\n");
> +
> +	tty_lock(tty);
> +	if (tty->ops->close)
> +		tty->ops->close(tty, NULL);
> +	tty_unlock(tty);
> +
> +	tty_kclose(tty);
>   
>   	return ret;
>   }
> 


-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20210308/941570ef/attachment-0001.sig>