Revision 513dc792d6060d5ef572e43852683097a8420f56 authored by Zhang Xiaoxu on 04 March 2020, 02:24:29 UTC, committed by Daniel Vetter on 06 March 2020, 20:06:34 UTC
When syzkaller tests, there is a UAF: BUG: KASan: use after free in vgacon_invert_region+0x9d/0x110 at addr ffff880000100000 Read of size 2 by task syz-executor.1/16489 page:ffffea0000004000 count:0 mapcount:-127 mapping: (null) index:0x0 page flags: 0xfffff00000000() page dumped because: kasan: bad access detected CPU: 1 PID: 16489 Comm: syz-executor.1 Not tainted Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2014 Call Trace: [<ffffffffb119f309>] dump_stack+0x1e/0x20 [<ffffffffb04af957>] kasan_report+0x577/0x950 [<ffffffffb04ae652>] __asan_load2+0x62/0x80 [<ffffffffb090f26d>] vgacon_invert_region+0x9d/0x110 [<ffffffffb0a39d95>] invert_screen+0xe5/0x470 [<ffffffffb0a21dcb>] set_selection+0x44b/0x12f0 [<ffffffffb0a3bfae>] tioclinux+0xee/0x490 [<ffffffffb0a1d114>] vt_ioctl+0xff4/0x2670 [<ffffffffb0a0089a>] tty_ioctl+0x46a/0x1a10 [<ffffffffb052db3d>] do_vfs_ioctl+0x5bd/0xc40 [<ffffffffb052e2f2>] SyS_ioctl+0x132/0x170 [<ffffffffb11c9b1b>] system_call_fastpath+0x22/0x27 Memory state around the buggy address: ffff8800000fff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8800000fff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff880000100000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff It can be reproduce in the linux mainline by the program: #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <fcntl.h> #include <sys/types.h> #include <sys/stat.h> #include <sys/ioctl.h> #include <linux/vt.h> struct tiocl_selection { unsigned short xs; /* X start */ unsigned short ys; /* Y start */ unsigned short xe; /* X end */ unsigned short ye; /* Y end */ unsigned short sel_mode; /* selection mode */ }; #define TIOCL_SETSEL 2 struct tiocl { unsigned char type; unsigned char pad; struct tiocl_selection sel; }; int main() { int fd = 0; const char *dev = "/dev/char/4:1"; struct vt_consize v = {0}; struct tiocl tioc = {0}; fd = open(dev, O_RDWR, 0); v.v_rows = 3346; ioctl(fd, VT_RESIZEX, &v); tioc.type = TIOCL_SETSEL; ioctl(fd, TIOCLINUX, &tioc); return 0; } When resize the screen, update the 'vc->vc_size_row' to the new_row_size, but when 'set_origin' in 'vgacon_set_origin', vgacon use 'vga_vram_base' for 'vc_origin' and 'vc_visible_origin', not 'vc_screenbuf'. It maybe smaller than 'vc_screenbuf'. When TIOCLINUX, use the new_row_size to calc the offset, it maybe larger than the vga_vram_size in vgacon driver, then bad access. Also, if set an larger screenbuf firstly, then set an more larger screenbuf, when copy old_origin to new_origin, a bad access may happen. So, If the screen size larger than vga_vram, resize screen should be failed. This alse fix CVE-2020-8649 and CVE-2020-8647. Linus pointed out that overflow checking seems absent. We're saved by the existing bounds checks in vc_do_resize() with rather strict limits: if (cols > VC_RESIZE_MAXCOL || lines > VC_RESIZE_MAXROW) return -EINVAL; Fixes: 0aec4867dca14 ("[PATCH] SVGATextMode fix") Reference: CVE-2020-8647 and CVE-2020-8649 Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5@huawei.com> [danvet: augment commit message to point out overflow safety] Cc: stable@vger.kernel.org Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> Link: https://patchwork.freedesktop.org/patch/msgid/20200304022429.37738-1-zhangxiaoxu5@huawei.com
1 parent 2ac4853
umem.h
/* SPDX-License-Identifier: GPL-2.0-only */
/*
* This file contains defines for the
* Micro Memory MM5415
* family PCI Memory Module with Battery Backup.
*
* Copyright Micro Memory INC 2001. All rights reserved.
*/
#ifndef _DRIVERS_BLOCK_MM_H
#define _DRIVERS_BLOCK_MM_H
#define IRQ_TIMEOUT (1 * HZ)
/* CSR register definition */
#define MEMCTRLSTATUS_MAGIC 0x00
#define MM_MAGIC_VALUE (unsigned char)0x59
#define MEMCTRLSTATUS_BATTERY 0x04
#define BATTERY_1_DISABLED 0x01
#define BATTERY_1_FAILURE 0x02
#define BATTERY_2_DISABLED 0x04
#define BATTERY_2_FAILURE 0x08
#define MEMCTRLSTATUS_MEMORY 0x07
#define MEM_128_MB 0xfe
#define MEM_256_MB 0xfc
#define MEM_512_MB 0xf8
#define MEM_1_GB 0xf0
#define MEM_2_GB 0xe0
#define MEMCTRLCMD_LEDCTRL 0x08
#define LED_REMOVE 2
#define LED_FAULT 4
#define LED_POWER 6
#define LED_FLIP 255
#define LED_OFF 0x00
#define LED_ON 0x01
#define LED_FLASH_3_5 0x02
#define LED_FLASH_7_0 0x03
#define LED_POWER_ON 0x00
#define LED_POWER_OFF 0x01
#define USER_BIT1 0x01
#define USER_BIT2 0x02
#define MEMORY_INITIALIZED USER_BIT1
#define MEMCTRLCMD_ERRCTRL 0x0C
#define EDC_NONE_DEFAULT 0x00
#define EDC_NONE 0x01
#define EDC_STORE_READ 0x02
#define EDC_STORE_CORRECT 0x03
#define MEMCTRLCMD_ERRCNT 0x0D
#define MEMCTRLCMD_ERRSTATUS 0x0E
#define ERROR_DATA_LOG 0x20
#define ERROR_ADDR_LOG 0x28
#define ERROR_COUNT 0x3D
#define ERROR_SYNDROME 0x3E
#define ERROR_CHECK 0x3F
#define DMA_PCI_ADDR 0x40
#define DMA_LOCAL_ADDR 0x48
#define DMA_TRANSFER_SIZE 0x50
#define DMA_DESCRIPTOR_ADDR 0x58
#define DMA_SEMAPHORE_ADDR 0x60
#define DMA_STATUS_CTRL 0x68
#define DMASCR_GO 0x00001
#define DMASCR_TRANSFER_READ 0x00002
#define DMASCR_CHAIN_EN 0x00004
#define DMASCR_SEM_EN 0x00010
#define DMASCR_DMA_COMP_EN 0x00020
#define DMASCR_CHAIN_COMP_EN 0x00040
#define DMASCR_ERR_INT_EN 0x00080
#define DMASCR_PARITY_INT_EN 0x00100
#define DMASCR_ANY_ERR 0x00800
#define DMASCR_MBE_ERR 0x01000
#define DMASCR_PARITY_ERR_REP 0x02000
#define DMASCR_PARITY_ERR_DET 0x04000
#define DMASCR_SYSTEM_ERR_SIG 0x08000
#define DMASCR_TARGET_ABT 0x10000
#define DMASCR_MASTER_ABT 0x20000
#define DMASCR_DMA_COMPLETE 0x40000
#define DMASCR_CHAIN_COMPLETE 0x80000
/*
3.SOME PCs HAVE HOST BRIDGES WHICH APPARENTLY DO NOT CORRECTLY HANDLE
READ-LINE (0xE) OR READ-MULTIPLE (0xC) PCI COMMAND CODES DURING DMA
TRANSFERS. IN OTHER SYSTEMS THESE COMMAND CODES WILL CAUSE THE HOST BRIDGE
TO ALLOW LONGER BURSTS DURING DMA READ OPERATIONS. THE UPPER FOUR BITS
(31..28) OF THE DMA CSR HAVE BEEN MADE PROGRAMMABLE, SO THAT EITHER A 0x6,
AN 0xE OR A 0xC CAN BE WRITTEN TO THEM TO SET THE COMMAND CODE USED DURING
DMA READ OPERATIONS.
*/
#define DMASCR_READ 0x60000000
#define DMASCR_READLINE 0xE0000000
#define DMASCR_READMULTI 0xC0000000
#define DMASCR_ERROR_MASK (DMASCR_MASTER_ABT | DMASCR_TARGET_ABT | DMASCR_SYSTEM_ERR_SIG | DMASCR_PARITY_ERR_DET | DMASCR_MBE_ERR | DMASCR_ANY_ERR)
#define DMASCR_HARD_ERROR (DMASCR_MASTER_ABT | DMASCR_TARGET_ABT | DMASCR_SYSTEM_ERR_SIG | DMASCR_PARITY_ERR_DET | DMASCR_MBE_ERR)
#define WINDOWMAP_WINNUM 0x7B
#define DMA_READ_FROM_HOST 0
#define DMA_WRITE_TO_HOST 1
struct mm_dma_desc {
__le64 pci_addr;
__le64 local_addr;
__le32 transfer_size;
u32 zero1;
__le64 next_desc_addr;
__le64 sem_addr;
__le32 control_bits;
u32 zero2;
dma_addr_t data_dma_handle;
/* Copy of the bits */
__le64 sem_control_bits;
} __attribute__((aligned(8)));
/* bits for card->flags */
#define UM_FLAG_DMA_IN_REGS 1
#define UM_FLAG_NO_BYTE_STATUS 2
#define UM_FLAG_NO_BATTREG 4
#define UM_FLAG_NO_BATT 8
#endif
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...