Revision 513dc792d6060d5ef572e43852683097a8420f56 authored by Zhang Xiaoxu on 04 March 2020, 02:24:29 UTC, committed by Daniel Vetter on 06 March 2020, 20:06:34 UTC
When syzkaller tests, there is a UAF: BUG: KASan: use after free in vgacon_invert_region+0x9d/0x110 at addr ffff880000100000 Read of size 2 by task syz-executor.1/16489 page:ffffea0000004000 count:0 mapcount:-127 mapping: (null) index:0x0 page flags: 0xfffff00000000() page dumped because: kasan: bad access detected CPU: 1 PID: 16489 Comm: syz-executor.1 Not tainted Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2014 Call Trace: [<ffffffffb119f309>] dump_stack+0x1e/0x20 [<ffffffffb04af957>] kasan_report+0x577/0x950 [<ffffffffb04ae652>] __asan_load2+0x62/0x80 [<ffffffffb090f26d>] vgacon_invert_region+0x9d/0x110 [<ffffffffb0a39d95>] invert_screen+0xe5/0x470 [<ffffffffb0a21dcb>] set_selection+0x44b/0x12f0 [<ffffffffb0a3bfae>] tioclinux+0xee/0x490 [<ffffffffb0a1d114>] vt_ioctl+0xff4/0x2670 [<ffffffffb0a0089a>] tty_ioctl+0x46a/0x1a10 [<ffffffffb052db3d>] do_vfs_ioctl+0x5bd/0xc40 [<ffffffffb052e2f2>] SyS_ioctl+0x132/0x170 [<ffffffffb11c9b1b>] system_call_fastpath+0x22/0x27 Memory state around the buggy address: ffff8800000fff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8800000fff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff880000100000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff It can be reproduce in the linux mainline by the program: #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <fcntl.h> #include <sys/types.h> #include <sys/stat.h> #include <sys/ioctl.h> #include <linux/vt.h> struct tiocl_selection { unsigned short xs; /* X start */ unsigned short ys; /* Y start */ unsigned short xe; /* X end */ unsigned short ye; /* Y end */ unsigned short sel_mode; /* selection mode */ }; #define TIOCL_SETSEL 2 struct tiocl { unsigned char type; unsigned char pad; struct tiocl_selection sel; }; int main() { int fd = 0; const char *dev = "/dev/char/4:1"; struct vt_consize v = {0}; struct tiocl tioc = {0}; fd = open(dev, O_RDWR, 0); v.v_rows = 3346; ioctl(fd, VT_RESIZEX, &v); tioc.type = TIOCL_SETSEL; ioctl(fd, TIOCLINUX, &tioc); return 0; } When resize the screen, update the 'vc->vc_size_row' to the new_row_size, but when 'set_origin' in 'vgacon_set_origin', vgacon use 'vga_vram_base' for 'vc_origin' and 'vc_visible_origin', not 'vc_screenbuf'. It maybe smaller than 'vc_screenbuf'. When TIOCLINUX, use the new_row_size to calc the offset, it maybe larger than the vga_vram_size in vgacon driver, then bad access. Also, if set an larger screenbuf firstly, then set an more larger screenbuf, when copy old_origin to new_origin, a bad access may happen. So, If the screen size larger than vga_vram, resize screen should be failed. This alse fix CVE-2020-8649 and CVE-2020-8647. Linus pointed out that overflow checking seems absent. We're saved by the existing bounds checks in vc_do_resize() with rather strict limits: if (cols > VC_RESIZE_MAXCOL || lines > VC_RESIZE_MAXROW) return -EINVAL; Fixes: 0aec4867dca14 ("[PATCH] SVGATextMode fix") Reference: CVE-2020-8647 and CVE-2020-8649 Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5@huawei.com> [danvet: augment commit message to point out overflow safety] Cc: stable@vger.kernel.org Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> Link: https://patchwork.freedesktop.org/patch/msgid/20200304022429.37738-1-zhangxiaoxu5@huawei.com
1 parent 2ac4853
rtc-ab3100.c
// SPDX-License-Identifier: GPL-2.0
/*
* Copyright (C) 2007-2009 ST-Ericsson AB
* RTC clock driver for the AB3100 Analog Baseband Chip
* Author: Linus Walleij <linus.walleij@stericsson.com>
*/
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/platform_device.h>
#include <linux/rtc.h>
#include <linux/mfd/abx500.h>
/* Clock rate in Hz */
#define AB3100_RTC_CLOCK_RATE 32768
/*
* The AB3100 RTC registers. These are the same for
* AB3000 and AB3100.
* Control register:
* Bit 0: RTC Monitor cleared=0, active=1, if you set it
* to 1 it remains active until RTC power is lost.
* Bit 1: 32 kHz Oscillator, 0 = on, 1 = bypass
* Bit 2: Alarm on, 0 = off, 1 = on
* Bit 3: 32 kHz buffer disabling, 0 = enabled, 1 = disabled
*/
#define AB3100_RTC 0x53
/* default setting, buffer disabled, alarm on */
#define RTC_SETTING 0x30
/* Alarm when AL0-AL3 == TI0-TI3 */
#define AB3100_AL0 0x56
#define AB3100_AL1 0x57
#define AB3100_AL2 0x58
#define AB3100_AL3 0x59
/* This 48-bit register that counts up at 32768 Hz */
#define AB3100_TI0 0x5a
#define AB3100_TI1 0x5b
#define AB3100_TI2 0x5c
#define AB3100_TI3 0x5d
#define AB3100_TI4 0x5e
#define AB3100_TI5 0x5f
/*
* RTC clock functions and device struct declaration
*/
static int ab3100_rtc_set_time(struct device *dev, struct rtc_time *tm)
{
u8 regs[] = {AB3100_TI0, AB3100_TI1, AB3100_TI2,
AB3100_TI3, AB3100_TI4, AB3100_TI5};
unsigned char buf[6];
u64 hw_counter = rtc_tm_to_time64(tm) * AB3100_RTC_CLOCK_RATE * 2;
int err = 0;
int i;
buf[0] = (hw_counter) & 0xFF;
buf[1] = (hw_counter >> 8) & 0xFF;
buf[2] = (hw_counter >> 16) & 0xFF;
buf[3] = (hw_counter >> 24) & 0xFF;
buf[4] = (hw_counter >> 32) & 0xFF;
buf[5] = (hw_counter >> 40) & 0xFF;
for (i = 0; i < 6; i++) {
err = abx500_set_register_interruptible(dev, 0,
regs[i], buf[i]);
if (err)
return err;
}
/* Set the flag to mark that the clock is now set */
return abx500_mask_and_set_register_interruptible(dev, 0,
AB3100_RTC,
0x01, 0x01);
}
static int ab3100_rtc_read_time(struct device *dev, struct rtc_time *tm)
{
time64_t time;
u8 rtcval;
int err;
err = abx500_get_register_interruptible(dev, 0,
AB3100_RTC, &rtcval);
if (err)
return err;
if (!(rtcval & 0x01)) {
dev_info(dev, "clock not set (lost power)");
return -EINVAL;
} else {
u64 hw_counter;
u8 buf[6];
/* Read out time registers */
err = abx500_get_register_page_interruptible(dev, 0,
AB3100_TI0,
buf, 6);
if (err != 0)
return err;
hw_counter = ((u64) buf[5] << 40) | ((u64) buf[4] << 32) |
((u64) buf[3] << 24) | ((u64) buf[2] << 16) |
((u64) buf[1] << 8) | (u64) buf[0];
time = hw_counter / (u64) (AB3100_RTC_CLOCK_RATE * 2);
}
rtc_time64_to_tm(time, tm);
return 0;
}
static int ab3100_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alarm)
{
time64_t time;
u64 hw_counter;
u8 buf[6];
u8 rtcval;
int err;
/* Figure out if alarm is enabled or not */
err = abx500_get_register_interruptible(dev, 0,
AB3100_RTC, &rtcval);
if (err)
return err;
if (rtcval & 0x04)
alarm->enabled = 1;
else
alarm->enabled = 0;
/* No idea how this could be represented */
alarm->pending = 0;
/* Read out alarm registers, only 4 bytes */
err = abx500_get_register_page_interruptible(dev, 0,
AB3100_AL0, buf, 4);
if (err)
return err;
hw_counter = ((u64) buf[3] << 40) | ((u64) buf[2] << 32) |
((u64) buf[1] << 24) | ((u64) buf[0] << 16);
time = hw_counter / (u64) (AB3100_RTC_CLOCK_RATE * 2);
rtc_time64_to_tm(time, &alarm->time);
return rtc_valid_tm(&alarm->time);
}
static int ab3100_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alarm)
{
u8 regs[] = {AB3100_AL0, AB3100_AL1, AB3100_AL2, AB3100_AL3};
unsigned char buf[4];
time64_t secs;
u64 hw_counter;
int err;
int i;
secs = rtc_tm_to_time64(&alarm->time);
hw_counter = secs * AB3100_RTC_CLOCK_RATE * 2;
buf[0] = (hw_counter >> 16) & 0xFF;
buf[1] = (hw_counter >> 24) & 0xFF;
buf[2] = (hw_counter >> 32) & 0xFF;
buf[3] = (hw_counter >> 40) & 0xFF;
/* Set the alarm */
for (i = 0; i < 4; i++) {
err = abx500_set_register_interruptible(dev, 0,
regs[i], buf[i]);
if (err)
return err;
}
/* Then enable the alarm */
return abx500_mask_and_set_register_interruptible(dev, 0,
AB3100_RTC, (1 << 2),
alarm->enabled << 2);
}
static int ab3100_rtc_irq_enable(struct device *dev, unsigned int enabled)
{
/*
* It's not possible to enable/disable the alarm IRQ for this RTC.
* It does not actually trigger any IRQ: instead its only function is
* to power up the system, if it wasn't on. This will manifest as
* a "power up cause" in the AB3100 power driver (battery charging etc)
* and need to be handled there instead.
*/
if (enabled)
return abx500_mask_and_set_register_interruptible(dev, 0,
AB3100_RTC, (1 << 2),
1 << 2);
else
return abx500_mask_and_set_register_interruptible(dev, 0,
AB3100_RTC, (1 << 2),
0);
}
static const struct rtc_class_ops ab3100_rtc_ops = {
.read_time = ab3100_rtc_read_time,
.set_time = ab3100_rtc_set_time,
.read_alarm = ab3100_rtc_read_alarm,
.set_alarm = ab3100_rtc_set_alarm,
.alarm_irq_enable = ab3100_rtc_irq_enable,
};
static int __init ab3100_rtc_probe(struct platform_device *pdev)
{
int err;
u8 regval;
struct rtc_device *rtc;
/* The first RTC register needs special treatment */
err = abx500_get_register_interruptible(&pdev->dev, 0,
AB3100_RTC, ®val);
if (err) {
dev_err(&pdev->dev, "unable to read RTC register\n");
return -ENODEV;
}
if ((regval & 0xFE) != RTC_SETTING) {
dev_warn(&pdev->dev, "not default value in RTC reg 0x%x\n",
regval);
}
if ((regval & 1) == 0) {
/*
* Set bit to detect power loss.
* This bit remains until RTC power is lost.
*/
regval = 1 | RTC_SETTING;
err = abx500_set_register_interruptible(&pdev->dev, 0,
AB3100_RTC, regval);
/* Ignore any error on this write */
}
rtc = devm_rtc_allocate_device(&pdev->dev);
if (IS_ERR(rtc))
return PTR_ERR(rtc);
rtc->ops = &ab3100_rtc_ops;
/* 48bit counter at (AB3100_RTC_CLOCK_RATE * 2) */
rtc->range_max = U32_MAX;
platform_set_drvdata(pdev, rtc);
return rtc_register_device(rtc);
}
static struct platform_driver ab3100_rtc_driver = {
.driver = {
.name = "ab3100-rtc",
},
};
module_platform_driver_probe(ab3100_rtc_driver, ab3100_rtc_probe);
MODULE_AUTHOR("Linus Walleij <linus.walleij@stericsson.com>");
MODULE_DESCRIPTION("AB3100 RTC Driver");
MODULE_LICENSE("GPL");
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...