From patchwork Mon Oct 8 02:39:17 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Miles Chen X-Patchwork-Id: 10629863 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id C3FDD15E2 for ; Mon, 8 Oct 2018 02:39:33 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id B127528C99 for ; Mon, 8 Oct 2018 02:39:33 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id A3B4328CE4; Mon, 8 Oct 2018 02:39:33 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_NONE,UNPARSEABLE_RELAY autolearn=ham version=3.3.1 Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 07CEC28C99 for ; Mon, 8 Oct 2018 02:39:31 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 5C77E6B000A; Sun, 7 Oct 2018 22:39:30 -0400 (EDT) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id 574E96B000C; Sun, 7 Oct 2018 22:39:30 -0400 (EDT) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 48C966B000D; Sun, 7 Oct 2018 22:39:30 -0400 (EDT) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from mail-pl1-f198.google.com (mail-pl1-f198.google.com [209.85.214.198]) by kanga.kvack.org (Postfix) with ESMTP id 09D716B000A for ; Sun, 7 Oct 2018 22:39:30 -0400 (EDT) Received: by mail-pl1-f198.google.com with SMTP id f17-v6so16396845plr.1 for ; Sun, 07 Oct 2018 19:39:30 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-original-authentication-results:x-gm-message-state:from:to:cc :subject:date:message-id:mime-version; bh=DmoPdI7yjorl/Wpc0YPZuiNvk2baXC+XNKOF1MCzDoc=; b=GavZnRcNV6RaomWkyszMRzgDgpUmvjpuo3H4Chhw0wHrgFmalBHydl16v6Bb/BQMbh 6u7/Cnz0PKdk++ter6t/1OCXhv0b+aemhuS3dpKuNgFLtYroPt0ruJFO9R0voiYIQ/T7 bUEvcsIKP8IvDMCR3bdYiqzp1YQnH6R3tJXeHVyqlPvzWqJS+JzvN3FYXq+I3FCCNDOY +I5sup83M2wBGDyOQvJvG1Mo3h3Q1fjWKEKo0Hz0Z1hDrj6yM3gF/u8u69HE2ZPeSGtG N6evPng+RXH27lUzEbcMkfO1GqWGzsPaNBXIWKUVRyasW/MN9DTK4lW+3kh+Xpe1RD9V TtgQ== X-Original-Authentication-Results: mx.google.com; spf=pass (google.com: domain of miles.chen@mediatek.com designates 210.61.82.184 as permitted sender) smtp.mailfrom=miles.chen@mediatek.com X-Gm-Message-State: ABuFfog6pmzLhb6Z39Ubbw6mjopWWiHE9i8IwGqQMjUii8zIOtISDSFc sWooxZPwkIk/DBriZV8yTHWil5kvn8nXqahnRoDO2rB3p4JycvIgqdzJvI0aSe7VxuGI0suntPS 2fbrfGrS1AO3r5id6S40QjMS5BaE2AhH5qTb2EEq+bt5iWktcYMPH/V40ZVjL3gHu9Q== X-Received: by 2002:a17:902:5e3:: with SMTP id f90-v6mr22699286plf.286.1538966369661; Sun, 07 Oct 2018 19:39:29 -0700 (PDT) X-Google-Smtp-Source: ACcGV61Wa/EbCLFedd1Jc+I4a3Y0NdbjcZioFh87lBsZtR1KnDp4r2H3aUoSEq7aLmFj795jkZca X-Received: by 2002:a17:902:5e3:: with SMTP id f90-v6mr22699251plf.286.1538966368551; Sun, 07 Oct 2018 19:39:28 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1538966368; cv=none; d=google.com; s=arc-20160816; b=PfuShw1l5IBHWKu4Pdohbtvavk6CCO0KHUy5+Lt3KS5P0ghvg030CmUg4ABO3YPpJV vvleJu2M9SUqBTDR6P6Ft/O1gA3x1xzz61lnzyMjVrBjRQmVzWaM0+s1qdFbeNt4ZXeT mLIrxzL9Kn1uE9uJ7BHzWzfwGxSWHDGscL9wxvNrOWt4V/PbaGidyRqdgLABWBPydnDJ 3jonYG0GLmblrC3Pv03bgOMrjhChaxg3Qc5cMSz1Cp/O41J7iTgzmw2H96yqFaT3gE+s nIwdm2Q3HyAc6R5NxqJpaV3D5ZTR7OKhcAD0OPOsf/OVs7s+4KlLKUPBTc4fVM1OY4iT yQKA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=mime-version:message-id:date:subject:cc:to:from; bh=DmoPdI7yjorl/Wpc0YPZuiNvk2baXC+XNKOF1MCzDoc=; b=nR5teNSDiHUe38vax4H97HcZ2AuRxLDBUGTF18IeNUvCj8qgcn6oSZxzb2WoAhYXBu D0el4qbkCe1+nWeiwbonrDCUdo+QupvGmO6aqv6cvbYSfiJLqeSyKJFLCuXGZFQiMRlK 0w8wuMZsDPcsU6wDYyKUyTXK1d3pD+BpLEauyOAuPWwqV4TrHVtXUAGGJZLC9/RyALz9 V6AoqgJUtzKuBcx2/IzMSaaDTSdC6SuP2W0kBbUfvvBjS+TZDFVBg5Aa7cV/dz0bKP7I USP2RZsgrY0FD9BBb9gRzYbdsQgsRa2tu0/XhTbx72hDY11YJfPOGMibfukC2ZJCrjhI NYPg== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of miles.chen@mediatek.com designates 210.61.82.184 as permitted sender) smtp.mailfrom=miles.chen@mediatek.com Received: from mailgw02.mediatek.com ([210.61.82.184]) by mx.google.com with ESMTPS id b7-v6si18054473pfm.93.2018.10.07.19.39.27 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sun, 07 Oct 2018 19:39:28 -0700 (PDT) Received-SPF: pass (google.com: domain of miles.chen@mediatek.com designates 210.61.82.184 as permitted sender) client-ip=210.61.82.184; Authentication-Results: mx.google.com; spf=pass (google.com: domain of miles.chen@mediatek.com designates 210.61.82.184 as permitted sender) smtp.mailfrom=miles.chen@mediatek.com X-UUID: d93fccd3bcf04ab88e09eb6bbb2c0dc8-20181008 X-UUID: d93fccd3bcf04ab88e09eb6bbb2c0dc8-20181008 Received: from mtkcas06.mediatek.inc [(172.21.101.30)] by mailgw02.mediatek.com (envelope-from ) (mhqrelay.mediatek.com ESMTP with TLS) with ESMTP id 1696350349; Mon, 08 Oct 2018 10:39:21 +0800 Received: from mtkcas08.mediatek.inc (172.21.101.126) by mtkmbs08n1.mediatek.inc (172.21.101.55) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Mon, 8 Oct 2018 10:39:19 +0800 Received: from mtksdccf07.mediatek.inc (172.21.84.99) by mtkcas08.mediatek.inc (172.21.101.73) with Microsoft SMTP Server id 15.0.1395.4 via Frontend Transport; Mon, 8 Oct 2018 10:39:19 +0800 From: To: Greg Kroah-Hartman , Jiri Slaby CC: , , , , Mark Salyzyn , Miles Chen Subject: [PATCH] tty: check name length in tty_find_polling_driver() Date: Mon, 8 Oct 2018 10:39:17 +0800 Message-ID: <1538966357-3175-1-git-send-email-miles.chen@mediatek.com> X-Mailer: git-send-email 1.9.1 MIME-Version: 1.0 X-MTK: N X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: X-Virus-Scanned: ClamAV using ClamSMTP From: Miles Chen The issue is found by a fuzzing test. If tty_find_polling_driver() recevies an incorrect input such as ',,' or '0b', the len becomes 0 and strncmp() always return 0. In this case, a null p->ops->poll_init() is called and it causes a kernel panic. Fix this by checking name length against zero in tty_find_polling_driver(). $echo ,, > /sys/module/kgdboc/parameters/kgdboc [ 20.804451] WARNING: CPU: 1 PID: 104 at drivers/tty/serial/serial_core.c:457 uart_get_baud_rate+0xe8/0x190 [ 20.804917] Modules linked in: [ 20.805317] CPU: 1 PID: 104 Comm: sh Not tainted 4.19.0-rc7ajb #8 [ 20.805469] Hardware name: linux,dummy-virt (DT) [ 20.805732] pstate: 20000005 (nzCv daif -PAN -UAO) [ 20.805895] pc : uart_get_baud_rate+0xe8/0x190 [ 20.806042] lr : uart_get_baud_rate+0xc0/0x190 [ 20.806476] sp : ffffffc06acff940 [ 20.806676] x29: ffffffc06acff940 x28: 0000000000002580 [ 20.806977] x27: 0000000000009600 x26: 0000000000009600 [ 20.807231] x25: ffffffc06acffad0 x24: 00000000ffffeff0 [ 20.807576] x23: 0000000000000001 x22: 0000000000000000 [ 20.807807] x21: 0000000000000001 x20: 0000000000000000 [ 20.808049] x19: ffffffc06acffac8 x18: 0000000000000000 [ 20.808277] x17: 0000000000000000 x16: 0000000000000000 [ 20.808520] x15: ffffffffffffffff x14: ffffffff00000000 [ 20.808757] x13: ffffffffffffffff x12: 0000000000000001 [ 20.809011] x11: 0101010101010101 x10: ffffff880d59ff5f [ 20.809292] x9 : ffffff880d59ff5e x8 : ffffffc06acffaf3 [ 20.809549] x7 : 0000000000000000 x6 : ffffff880d59ff5f [ 20.809803] x5 : 0000000080008001 x4 : 0000000000000003 [ 20.810056] x3 : ffffff900853e6b4 x2 : dfffff9000000000 [ 20.810693] x1 : ffffffc06acffad0 x0 : 0000000000000cb0 [ 20.811005] Call trace: [ 20.811214] uart_get_baud_rate+0xe8/0x190 [ 20.811479] serial8250_do_set_termios+0xe0/0x6f4 [ 20.811719] serial8250_set_termios+0x48/0x54 [ 20.811928] uart_set_options+0x138/0x1bc [ 20.812129] uart_poll_init+0x114/0x16c [ 20.812330] tty_find_polling_driver+0x158/0x200 [ 20.812545] configure_kgdboc+0xbc/0x1bc [ 20.812745] param_set_kgdboc_var+0xb8/0x150 [ 20.812960] param_attr_store+0xbc/0x150 [ 20.813160] module_attr_store+0x40/0x58 [ 20.813364] sysfs_kf_write+0x8c/0xa8 [ 20.813563] kernfs_fop_write+0x154/0x290 [ 20.813764] vfs_write+0xf0/0x278 [ 20.813951] __arm64_sys_write+0x84/0xf4 [ 20.814400] el0_svc_common+0xf4/0x1dc [ 20.814616] el0_svc_handler+0x98/0xbc [ 20.814804] el0_svc+0x8/0xc [ 20.822005] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 20.826913] Mem abort info: [ 20.827103] ESR = 0x84000006 [ 20.827352] Exception class = IABT (current EL), IL = 16 bits [ 20.827655] SET = 0, FnV = 0 [ 20.827855] EA = 0, S1PTW = 0 [ 20.828135] user pgtable: 4k pages, 39-bit VAs, pgdp = (____ptrval____) [ 20.828484] [0000000000000000] pgd=00000000aadee003, pud=00000000aadee003, pmd=0000000000000000 [ 20.829195] Internal error: Oops: 84000006 [#1] SMP [ 20.829564] Modules linked in: [ 20.829890] CPU: 1 PID: 104 Comm: sh Tainted: G W 4.19.0-rc7ajb #8 [ 20.830545] Hardware name: linux,dummy-virt (DT) [ 20.830829] pstate: 60000085 (nZCv daIf -PAN -UAO) [ 20.831174] pc : (null) [ 20.831457] lr : serial8250_do_set_termios+0x358/0x6f4 [ 20.831727] sp : ffffffc06acff9b0 [ 20.831936] x29: ffffffc06acff9b0 x28: ffffff9008d7c000 [ 20.832267] x27: ffffff900969e16f x26: 0000000000000000 [ 20.832589] x25: ffffff900969dfb0 x24: 0000000000000000 [ 20.832906] x23: ffffffc06acffad0 x22: ffffff900969e160 [ 20.833232] x21: 0000000000000000 x20: ffffffc06acffac8 [ 20.833559] x19: ffffff900969df90 x18: 0000000000000000 [ 20.833878] x17: 0000000000000000 x16: 0000000000000000 [ 20.834491] x15: ffffffffffffffff x14: ffffffff00000000 [ 20.834821] x13: ffffffffffffffff x12: 0000000000000001 [ 20.835143] x11: 0101010101010101 x10: ffffff880d59ff5f [ 20.835467] x9 : ffffff880d59ff5e x8 : ffffffc06acffaf3 [ 20.835790] x7 : 0000000000000000 x6 : ffffff880d59ff5f [ 20.836111] x5 : c06419717c314100 x4 : 0000000000000007 [ 20.836419] x3 : 0000000000000000 x2 : 0000000000000000 [ 20.836732] x1 : 0000000000000001 x0 : ffffff900969df90 [ 20.837100] Process sh (pid: 104, stack limit = 0x(____ptrval____)) [ 20.837396] Call trace: [ 20.837566] (null) [ 20.837816] serial8250_set_termios+0x48/0x54 [ 20.838089] uart_set_options+0x138/0x1bc [ 20.838570] uart_poll_init+0x114/0x16c [ 20.838834] tty_find_polling_driver+0x158/0x200 [ 20.839119] configure_kgdboc+0xbc/0x1bc [ 20.839380] param_set_kgdboc_var+0xb8/0x150 [ 20.839658] param_attr_store+0xbc/0x150 [ 20.839920] module_attr_store+0x40/0x58 [ 20.840183] sysfs_kf_write+0x8c/0xa8 [ 20.840183] sysfs_kf_write+0x8c/0xa8 [ 20.840440] kernfs_fop_write+0x154/0x290 [ 20.840702] vfs_write+0xf0/0x278 [ 20.840942] __arm64_sys_write+0x84/0xf4 [ 20.841209] el0_svc_common+0xf4/0x1dc [ 20.841471] el0_svc_handler+0x98/0xbc [ 20.841713] el0_svc+0x8/0xc [ 20.842057] Code: bad PC value [ 20.842764] ---[ end trace a8835d7de79aaadf ]--- [ 20.843134] Kernel panic - not syncing: Fatal exception [ 20.843515] SMP: stopping secondary CPUs [ 20.844289] Kernel Offset: disabled [ 20.844634] CPU features: 0x0,21806002 [ 20.844857] Memory Limit: none [ 20.845172] ---[ end Kernel panic - not syncing: Fatal exception ]--- Signed-off-by: Miles Chen --- drivers/tty/tty_io.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c index 5e5da9a..252eef2 100644 --- a/drivers/tty/tty_io.c +++ b/drivers/tty/tty_io.c @@ -408,7 +408,7 @@ struct tty_driver *tty_find_polling_driver(char *name, int *line) mutex_lock(&tty_mutex); /* Search through the tty devices to look for a match */ list_for_each_entry(p, &tty_drivers, tty_drivers) { - if (strncmp(name, p->name, len) != 0) + if (!len || strncmp(name, p->name, len) != 0) continue; stp = str; if (*stp == ',')