Revision 513dc792d6060d5ef572e43852683097a8420f56 authored by Zhang Xiaoxu on 04 March 2020, 02:24:29 UTC, committed by Daniel Vetter on 06 March 2020, 20:06:34 UTC
When syzkaller tests, there is a UAF: BUG: KASan: use after free in vgacon_invert_region+0x9d/0x110 at addr ffff880000100000 Read of size 2 by task syz-executor.1/16489 page:ffffea0000004000 count:0 mapcount:-127 mapping: (null) index:0x0 page flags: 0xfffff00000000() page dumped because: kasan: bad access detected CPU: 1 PID: 16489 Comm: syz-executor.1 Not tainted Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2014 Call Trace: [<ffffffffb119f309>] dump_stack+0x1e/0x20 [<ffffffffb04af957>] kasan_report+0x577/0x950 [<ffffffffb04ae652>] __asan_load2+0x62/0x80 [<ffffffffb090f26d>] vgacon_invert_region+0x9d/0x110 [<ffffffffb0a39d95>] invert_screen+0xe5/0x470 [<ffffffffb0a21dcb>] set_selection+0x44b/0x12f0 [<ffffffffb0a3bfae>] tioclinux+0xee/0x490 [<ffffffffb0a1d114>] vt_ioctl+0xff4/0x2670 [<ffffffffb0a0089a>] tty_ioctl+0x46a/0x1a10 [<ffffffffb052db3d>] do_vfs_ioctl+0x5bd/0xc40 [<ffffffffb052e2f2>] SyS_ioctl+0x132/0x170 [<ffffffffb11c9b1b>] system_call_fastpath+0x22/0x27 Memory state around the buggy address: ffff8800000fff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8800000fff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff880000100000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff It can be reproduce in the linux mainline by the program: #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <fcntl.h> #include <sys/types.h> #include <sys/stat.h> #include <sys/ioctl.h> #include <linux/vt.h> struct tiocl_selection { unsigned short xs; /* X start */ unsigned short ys; /* Y start */ unsigned short xe; /* X end */ unsigned short ye; /* Y end */ unsigned short sel_mode; /* selection mode */ }; #define TIOCL_SETSEL 2 struct tiocl { unsigned char type; unsigned char pad; struct tiocl_selection sel; }; int main() { int fd = 0; const char *dev = "/dev/char/4:1"; struct vt_consize v = {0}; struct tiocl tioc = {0}; fd = open(dev, O_RDWR, 0); v.v_rows = 3346; ioctl(fd, VT_RESIZEX, &v); tioc.type = TIOCL_SETSEL; ioctl(fd, TIOCLINUX, &tioc); return 0; } When resize the screen, update the 'vc->vc_size_row' to the new_row_size, but when 'set_origin' in 'vgacon_set_origin', vgacon use 'vga_vram_base' for 'vc_origin' and 'vc_visible_origin', not 'vc_screenbuf'. It maybe smaller than 'vc_screenbuf'. When TIOCLINUX, use the new_row_size to calc the offset, it maybe larger than the vga_vram_size in vgacon driver, then bad access. Also, if set an larger screenbuf firstly, then set an more larger screenbuf, when copy old_origin to new_origin, a bad access may happen. So, If the screen size larger than vga_vram, resize screen should be failed. This alse fix CVE-2020-8649 and CVE-2020-8647. Linus pointed out that overflow checking seems absent. We're saved by the existing bounds checks in vc_do_resize() with rather strict limits: if (cols > VC_RESIZE_MAXCOL || lines > VC_RESIZE_MAXROW) return -EINVAL; Fixes: 0aec4867dca14 ("[PATCH] SVGATextMode fix") Reference: CVE-2020-8647 and CVE-2020-8649 Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5@huawei.com> [danvet: augment commit message to point out overflow safety] Cc: stable@vger.kernel.org Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> Link: https://patchwork.freedesktop.org/patch/msgid/20200304022429.37738-1-zhangxiaoxu5@huawei.com
1 parent 2ac4853
rtc-cpcap.c
// SPDX-License-Identifier: GPL-2.0-only
/*
* Motorola CPCAP PMIC RTC driver
*
* Based on cpcap-regulator.c from Motorola Linux kernel tree
* Copyright (C) 2009 Motorola, Inc.
*
* Rewritten for mainline kernel
* - use DT
* - use regmap
* - use standard interrupt framework
* - use managed device resources
* - remove custom "secure clock daemon" helpers
*
* Copyright (C) 2017 Sebastian Reichel <sre@kernel.org>
*/
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/mod_devicetable.h>
#include <linux/init.h>
#include <linux/device.h>
#include <linux/platform_device.h>
#include <linux/rtc.h>
#include <linux/err.h>
#include <linux/regmap.h>
#include <linux/mfd/motorola-cpcap.h>
#include <linux/slab.h>
#include <linux/sched.h>
#define SECS_PER_DAY 86400
#define DAY_MASK 0x7FFF
#define TOD1_MASK 0x00FF
#define TOD2_MASK 0x01FF
struct cpcap_time {
int day;
int tod1;
int tod2;
};
struct cpcap_rtc {
struct regmap *regmap;
struct rtc_device *rtc_dev;
u16 vendor;
int alarm_irq;
bool alarm_enabled;
int update_irq;
bool update_enabled;
};
static void cpcap2rtc_time(struct rtc_time *rtc, struct cpcap_time *cpcap)
{
unsigned long int tod;
unsigned long int time;
tod = (cpcap->tod1 & TOD1_MASK) | ((cpcap->tod2 & TOD2_MASK) << 8);
time = tod + ((cpcap->day & DAY_MASK) * SECS_PER_DAY);
rtc_time_to_tm(time, rtc);
}
static void rtc2cpcap_time(struct cpcap_time *cpcap, struct rtc_time *rtc)
{
unsigned long time;
rtc_tm_to_time(rtc, &time);
cpcap->day = time / SECS_PER_DAY;
time %= SECS_PER_DAY;
cpcap->tod2 = (time >> 8) & TOD2_MASK;
cpcap->tod1 = time & TOD1_MASK;
}
static int cpcap_rtc_alarm_irq_enable(struct device *dev, unsigned int enabled)
{
struct cpcap_rtc *rtc = dev_get_drvdata(dev);
if (rtc->alarm_enabled == enabled)
return 0;
if (enabled)
enable_irq(rtc->alarm_irq);
else
disable_irq(rtc->alarm_irq);
rtc->alarm_enabled = !!enabled;
return 0;
}
static int cpcap_rtc_read_time(struct device *dev, struct rtc_time *tm)
{
struct cpcap_rtc *rtc;
struct cpcap_time cpcap_tm;
int temp_tod2;
int ret;
rtc = dev_get_drvdata(dev);
ret = regmap_read(rtc->regmap, CPCAP_REG_TOD2, &temp_tod2);
ret |= regmap_read(rtc->regmap, CPCAP_REG_DAY, &cpcap_tm.day);
ret |= regmap_read(rtc->regmap, CPCAP_REG_TOD1, &cpcap_tm.tod1);
ret |= regmap_read(rtc->regmap, CPCAP_REG_TOD2, &cpcap_tm.tod2);
if (temp_tod2 > cpcap_tm.tod2)
ret |= regmap_read(rtc->regmap, CPCAP_REG_DAY, &cpcap_tm.day);
if (ret) {
dev_err(dev, "Failed to read time\n");
return -EIO;
}
cpcap2rtc_time(tm, &cpcap_tm);
return 0;
}
static int cpcap_rtc_set_time(struct device *dev, struct rtc_time *tm)
{
struct cpcap_rtc *rtc;
struct cpcap_time cpcap_tm;
int ret = 0;
rtc = dev_get_drvdata(dev);
rtc2cpcap_time(&cpcap_tm, tm);
if (rtc->alarm_enabled)
disable_irq(rtc->alarm_irq);
if (rtc->update_enabled)
disable_irq(rtc->update_irq);
if (rtc->vendor == CPCAP_VENDOR_ST) {
/* The TOD1 and TOD2 registers MUST be written in this order
* for the change to properly set.
*/
ret |= regmap_update_bits(rtc->regmap, CPCAP_REG_TOD1,
TOD1_MASK, cpcap_tm.tod1);
ret |= regmap_update_bits(rtc->regmap, CPCAP_REG_TOD2,
TOD2_MASK, cpcap_tm.tod2);
ret |= regmap_update_bits(rtc->regmap, CPCAP_REG_DAY,
DAY_MASK, cpcap_tm.day);
} else {
/* Clearing the upper lower 8 bits of the TOD guarantees that
* the upper half of TOD (TOD2) will not increment for 0xFF RTC
* ticks (255 seconds). During this time we can safely write
* to DAY, TOD2, then TOD1 (in that order) and expect RTC to be
* synchronized to the exact time requested upon the final write
* to TOD1.
*/
ret |= regmap_update_bits(rtc->regmap, CPCAP_REG_TOD1,
TOD1_MASK, 0);
ret |= regmap_update_bits(rtc->regmap, CPCAP_REG_DAY,
DAY_MASK, cpcap_tm.day);
ret |= regmap_update_bits(rtc->regmap, CPCAP_REG_TOD2,
TOD2_MASK, cpcap_tm.tod2);
ret |= regmap_update_bits(rtc->regmap, CPCAP_REG_TOD1,
TOD1_MASK, cpcap_tm.tod1);
}
if (rtc->update_enabled)
enable_irq(rtc->update_irq);
if (rtc->alarm_enabled)
enable_irq(rtc->alarm_irq);
return ret;
}
static int cpcap_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm)
{
struct cpcap_rtc *rtc;
struct cpcap_time cpcap_tm;
int ret;
rtc = dev_get_drvdata(dev);
alrm->enabled = rtc->alarm_enabled;
ret = regmap_read(rtc->regmap, CPCAP_REG_DAYA, &cpcap_tm.day);
ret |= regmap_read(rtc->regmap, CPCAP_REG_TODA2, &cpcap_tm.tod2);
ret |= regmap_read(rtc->regmap, CPCAP_REG_TODA1, &cpcap_tm.tod1);
if (ret) {
dev_err(dev, "Failed to read time\n");
return -EIO;
}
cpcap2rtc_time(&alrm->time, &cpcap_tm);
return rtc_valid_tm(&alrm->time);
}
static int cpcap_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
{
struct cpcap_rtc *rtc;
struct cpcap_time cpcap_tm;
int ret;
rtc = dev_get_drvdata(dev);
rtc2cpcap_time(&cpcap_tm, &alrm->time);
if (rtc->alarm_enabled)
disable_irq(rtc->alarm_irq);
ret = regmap_update_bits(rtc->regmap, CPCAP_REG_DAYA, DAY_MASK,
cpcap_tm.day);
ret |= regmap_update_bits(rtc->regmap, CPCAP_REG_TODA2, TOD2_MASK,
cpcap_tm.tod2);
ret |= regmap_update_bits(rtc->regmap, CPCAP_REG_TODA1, TOD1_MASK,
cpcap_tm.tod1);
if (!ret) {
enable_irq(rtc->alarm_irq);
rtc->alarm_enabled = true;
}
return ret;
}
static const struct rtc_class_ops cpcap_rtc_ops = {
.read_time = cpcap_rtc_read_time,
.set_time = cpcap_rtc_set_time,
.read_alarm = cpcap_rtc_read_alarm,
.set_alarm = cpcap_rtc_set_alarm,
.alarm_irq_enable = cpcap_rtc_alarm_irq_enable,
};
static irqreturn_t cpcap_rtc_alarm_irq(int irq, void *data)
{
struct cpcap_rtc *rtc = data;
rtc_update_irq(rtc->rtc_dev, 1, RTC_AF | RTC_IRQF);
return IRQ_HANDLED;
}
static irqreturn_t cpcap_rtc_update_irq(int irq, void *data)
{
struct cpcap_rtc *rtc = data;
rtc_update_irq(rtc->rtc_dev, 1, RTC_UF | RTC_IRQF);
return IRQ_HANDLED;
}
static int cpcap_rtc_probe(struct platform_device *pdev)
{
struct device *dev = &pdev->dev;
struct cpcap_rtc *rtc;
int err;
rtc = devm_kzalloc(dev, sizeof(*rtc), GFP_KERNEL);
if (!rtc)
return -ENOMEM;
rtc->regmap = dev_get_regmap(dev->parent, NULL);
if (!rtc->regmap)
return -ENODEV;
platform_set_drvdata(pdev, rtc);
rtc->rtc_dev = devm_rtc_device_register(dev, "cpcap_rtc",
&cpcap_rtc_ops, THIS_MODULE);
if (IS_ERR(rtc->rtc_dev))
return PTR_ERR(rtc->rtc_dev);
err = cpcap_get_vendor(dev, rtc->regmap, &rtc->vendor);
if (err)
return err;
rtc->alarm_irq = platform_get_irq(pdev, 0);
err = devm_request_threaded_irq(dev, rtc->alarm_irq, NULL,
cpcap_rtc_alarm_irq, IRQF_TRIGGER_NONE,
"rtc_alarm", rtc);
if (err) {
dev_err(dev, "Could not request alarm irq: %d\n", err);
return err;
}
disable_irq(rtc->alarm_irq);
/* Stock Android uses the 1 Hz interrupt for "secure clock daemon",
* which is not supported by the mainline kernel. The mainline kernel
* does not use the irq at the moment, but we explicitly request and
* disable it, so that its masked and does not wake up the processor
* every second.
*/
rtc->update_irq = platform_get_irq(pdev, 1);
err = devm_request_threaded_irq(dev, rtc->update_irq, NULL,
cpcap_rtc_update_irq, IRQF_TRIGGER_NONE,
"rtc_1hz", rtc);
if (err) {
dev_err(dev, "Could not request update irq: %d\n", err);
return err;
}
disable_irq(rtc->update_irq);
err = device_init_wakeup(dev, 1);
if (err) {
dev_err(dev, "wakeup initialization failed (%d)\n", err);
/* ignore error and continue without wakeup support */
}
return 0;
}
static const struct of_device_id cpcap_rtc_of_match[] = {
{ .compatible = "motorola,cpcap-rtc", },
{},
};
MODULE_DEVICE_TABLE(of, cpcap_rtc_of_match);
static struct platform_driver cpcap_rtc_driver = {
.probe = cpcap_rtc_probe,
.driver = {
.name = "cpcap-rtc",
.of_match_table = cpcap_rtc_of_match,
},
};
module_platform_driver(cpcap_rtc_driver);
MODULE_ALIAS("platform:cpcap-rtc");
MODULE_DESCRIPTION("CPCAP RTC driver");
MODULE_AUTHOR("Sebastian Reichel <sre@kernel.org>");
MODULE_LICENSE("GPL");
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...