Patch "net: irda: Fix use-after-free in irtty_open()" has been added to the 4.4-stable tree
Subsystems (2)
This is a note to let you know that I've just added the patch titled
net: irda: Fix use-after-free in irtty_open()
to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
net-irda-fix-use-after-free-in-irtty_open.patch
and it can be found in the queue-4.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.
Quoted 1 line
From
401879c57f01cbf2da204ad2e8db910525c6dbeaMon Sep 17 00:00:00 2001
From: Peter Hurley <[email protected]>
Date: Sat, 9 Jan 2016 17:48:45 -0800
Subject: net: irda: Fix use-after-free in irtty_open()
From: Peter Hurley <[email protected]>
commit 401879c57f01cbf2da204ad2e8db910525c6dbea upstream.
The N_IRDA line discipline may access the previous line discipline's closed and already-fre private data on open [1].
The tty->disc_data field _never_ refers to valid data on entry to the line discipline's open() method. Rather, the ldisc is expected to initialize that field for its own use for the lifetime of the instance (ie. from open() to close() only).
[1]
==================================================================
BUG: KASAN: use-after-free in irtty_open+0x422/0x550 at addr ffff8800331dd068
Read of size 4 by task a.out/13960
=============================================================================
BUG kmalloc-512 (Tainted: G B ): kasan: bad access detected
-----------------------------------------------------------------------------
...
Call Trace:
[<ffffffff815fa2ae>] __asan_report_load4_noabort+0x3e/0x40 mm/kasan/report.c:279
[<ffffffff836938a2>] irtty_open+0x422/0x550 drivers/net/irda/irtty-sir.c:436
[<ffffffff829f1b80>] tty_ldisc_open.isra.2+0x60/0xa0 drivers/tty/tty_ldisc.c:447
[<ffffffff829f21c0>] tty_set_ldisc+0x1a0/0x940 drivers/tty/tty_ldisc.c:567
[< inline >] tiocsetd drivers/tty/tty_io.c:2650
[<ffffffff829da49e>] tty_ioctl+0xace/0x1fd0 drivers/tty/tty_io.c:2883
[< inline >] vfs_ioctl fs/ioctl.c:43
[<ffffffff816708ac>] do_vfs_ioctl+0x57c/0xe60 fs/ioctl.c:607
[< inline >] SYSC_ioctl fs/ioctl.c:622
[<ffffffff81671204>] SyS_ioctl+0x74/0x80 fs/ioctl.c:613
[<ffffffff852a7876>] entry_SYSCALL_64_fastpath+0x16/0x7a--- drivers/net/irda/irtty-sir.c | 10 ---------- 1 file changed, 10 deletions(-)
drivers/net/irda/irtty-sir.c +0 -10
@@ -430,16 +430,6 @@ static int irtty_open(struct tty_struct/* Module stuff handled via irda_ldisc.owner - Jean II */ -/* First make sure we're not already connected. */ -if (tty->disc_data !=NULL ) { - priv = tty->disc_data; -if (priv && priv->magic ==IRTTY_MAGIC ) { - ret = -EEXIST ; - goto out; - } - tty->disc_data =NULL ;/* ### */ - } -/* stop the underlying driver */ irtty_stop_receiver (tty, TRUE);if (tty->ops->stop)
Patches currently in stable-queue which might be from [email protected] are
queue-4.4/tty-fix-gpf-in-flush_to_ldisc-part-2.patch queue-4.4/8250-use-callbacks-to-access-uart_dll-uart_dlm.patch queue-4.4/net-irda-fix-use-after-free-in-irtty_open.patch