Jiri Slaby 82e61c3909 vt: keyboard, extend func_buf_lock to readers ... Both read-side users of func_table/func_buf need locking. Without that, one can easily confuse the code by repeatedly setting altering strings like: while (1) for (a = 0; a < 2; a++) { struct kbsentry kbs = {}; strcpy((char *)kbs.kb_string, a ? ".\n" : "88888\n"); ioctl(fd, KDSKBSENT, &kbs); } When that program runs, one can get unexpected output by holding F1 (note the unxpected period on the last line): . 88888 .8888 So protect all accesses to 'func_table' (and func_buf) by preexisting 'func_buf_lock'. It is easy in 'k_fn' handler as 'puts_queue' is expected not to sleep. On the other hand, KDGKBSENT needs a local (atomic) copy of the string because copy_to_user can sleep. Use already allocated, but unused 'kbs->kb_string' for that purpose. Note that the program above needs at least CAP_SYS_TTY_CONFIG. This depends on the previous patch and on the func_buf_lock lock added in commit 46ca3f735f (tty/vt: fix write/write race in ioctl(KDSKBSENT) handler) in 5.2. Likely fixes CVE-2020-25656. Cc: <stable@vger.kernel.org> Reported-by: Minh Yuan <yuanmingbuaa@gmail.com> Signed-off-by: Jiri Slaby <jslaby@suse.cz> Link: https://lore.kernel.org/r/20201019085517.10176-2-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2020-10-28 13:41:02 +01:00
..
accessibility
acpi	More ACPI updates for 5.10-rc1	2020-10-23 16:38:36 -07:00
amba
android	task_work: cleanup notification modes	2020-10-17 15:05:30 -06:00
ata	Merge branch 'parisc-5.10-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux	2020-10-25 10:59:34 -07:00
atm
auxdisplay
base	More power management updates for 5.10-rc1	2020-10-23 16:27:03 -07:00
bcma
block	xen: branch for v5.10-rc1c	2020-10-25 10:55:35 -07:00
bluetooth	networking changes for the 5.10 merge window	2020-10-15 18:42:13 -07:00
bus	ARM: SoC-related driver updates	2020-10-24 10:39:22 -07:00
cdrom
char	random32: make prandom_u32() output unpredictable	2020-10-24 20:21:57 +02:00
clk	treewide: Convert macro and uses of __section(foo) to __section("foo")	2020-10-25 14:51:49 -07:00
clocksource	treewide: Convert macro and uses of __section(foo) to __section("foo")	2020-10-25 14:51:49 -07:00
connector
counter
cpufreq	ARM: SoC-related driver updates	2020-10-24 10:39:22 -07:00
cpuidle	powerpc updates for 5.10	2020-10-16 12:21:15 -07:00
crypto	s390 updates for the 5.10 merge window	2020-10-16 12:36:38 -07:00
dax	fuse update for 5.10	2020-10-19 14:28:30 -07:00
dca
devfreq
dio
dma	ARM: SoC-related driver updates	2020-10-24 10:39:22 -07:00
dma-buf	dma-mapping updates for 5.10	2020-10-15 14:43:29 -07:00
edac	EFI changes for v5.10:	2020-10-12 13:26:49 -07:00
eisa
extcon
firewire
firmware	ARM: SoC-related driver updates	2020-10-24 10:39:22 -07:00
fpga
fsi
gnss
gpio	- New Drivers	2020-10-14 15:56:58 -07:00
gpu	ARM: SoC-related driver updates	2020-10-24 10:39:22 -07:00
greybus
hid	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input	2020-10-23 16:16:31 -07:00
hsi
hv	Merge branch 'akpm' (patches from Andrew)	2020-10-16 11:31:55 -07:00
hwmon	ARM: SoC platform updates	2020-10-24 10:33:08 -07:00
hwspinlock
hwtracing	intel_th: pci: Add Alder Lake CPU support	2020-10-05 12:43:54 +02:00
i2c	i2c: core: Restore acpi_walk_dep_device_list() getting called after registering the ACPI i2c devs	2020-10-25 13:33:54 +01:00
i3c	* Fix DAA for the pre-reserved address case	2020-10-17 11:01:01 -07:00
ide	block-5.10-2020-10-12	2020-10-13 12:12:44 -07:00
idle	intel_idle: Ignore _CST if control cannot be taken from the platform	2020-10-16 17:28:32 +02:00
iio	chrome platform changes for 5.10	2020-10-23 10:54:13 -07:00
infiniband	RDMA 5.10 pull request	2020-10-17 11:18:18 -07:00
input	Merge branch 'parisc-5.10-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux	2020-10-25 10:59:34 -07:00
interconnect
iommu	IOMMU Fix for Linux v5.10:	2020-10-20 09:35:06 -07:00
ipack
irqchip	treewide: Convert macro and uses of __section(foo) to __section("foo")	2020-10-25 14:51:49 -07:00
isdn
leds	leds: pwm: Remove platform_data support	2020-10-07 12:02:58 +02:00
lightnvm	lightnvm: fix out-of-bounds write to array devices->info[]	2020-10-16 09:28:45 -06:00
macintosh	powerpc updates for 5.10	2020-10-16 12:21:15 -07:00
mailbox	ARM: SoC-related driver updates	2020-10-24 10:39:22 -07:00
mcb
md	- Improve DM core's bio splitting to use blk_max_size_offset(). Also	2020-10-14 15:05:38 -07:00
media	dma-mapping updates for 5.10	2020-10-15 14:43:29 -07:00
memory	ARM: SoC-related driver updates	2020-10-24 10:39:22 -07:00
memstick
message	SCSI misc on 20201013	2020-10-14 15:15:35 -07:00
mfd	- New Drivers	2020-10-14 15:56:58 -07:00
misc	pci-v5.10-changes	2020-10-22 12:41:00 -07:00
mmc	ARM: SoC platform updates	2020-10-24 10:33:08 -07:00
most
mtd	This pull request contains fixes for UBI and UBIFS	2020-10-18 09:56:50 -07:00
mux
net	Fixes for 5.10-rc1 from the networking tree:	2020-10-23 12:05:49 -07:00
nfc	nfc: remove unneeded break	2020-10-20 10:36:41 -07:00
ntb	Bug fixes for v5.10	2020-10-25 11:12:31 -07:00
nubus
nvdimm	mm/memremap_pages: support multiple ranges per invocation	2020-10-13 18:38:28 -07:00
nvme	nvme-fc: shorten reconnect delay if possible for FC	2020-10-23 12:54:45 +02:00
nvmem
of	treewide: Convert macro and uses of __section(foo) to __section("foo")	2020-10-25 14:51:49 -07:00
opp	Merge branch 'cpufreq/arm/linux-next' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm	2020-10-06 12:26:45 +02:00
oprofile
parisc	dma-mapping: split <linux/dma-mapping.h>	2020-10-06 07:07:03 +02:00
parport
pci	VFIO updates for v5.10-rc1	2020-10-22 13:00:44 -07:00
pcmcia
perf
phy	pci-v5.10-changes	2020-10-22 12:41:00 -07:00
pinctrl	Pin control bulk changes for the v5.10 kernel cycle	2020-10-14 15:25:04 -07:00
platform	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input	2020-10-23 16:16:31 -07:00
pnp	PNP: remove the now unused pnp_find_card() function	2020-10-08 18:00:08 +02:00
power	ARM: SoC platform updates	2020-10-24 10:33:08 -07:00
powercap	powercap: Fix typo in Kconfig "Plance" -> "Plane"	2020-10-19 17:40:53 +02:00
pps
ps3
ptp
pwm	ARM: SoC platform updates	2020-10-24 10:33:08 -07:00
rapidio	rapidio: fix the missed put_device() for rio_mport_add_riodev	2020-10-16 11:11:22 -07:00
ras
regulator	Merge remote-tracking branch 'regulator/for-5.10' into regulator-next	2020-10-05 16:54:56 +01:00
remoteproc	remoteproc updates for v5.10	2020-10-22 12:56:33 -07:00
reset	ARM: SoC-related driver updates	2020-10-24 10:39:22 -07:00
rpmsg	rpmsg updates for 5.10	2020-10-22 12:58:21 -07:00
rtc	RTC for 5.10	2020-10-21 11:22:08 -07:00
s390	s390 updates for the 5.10 merge window	2020-10-16 12:36:38 -07:00
sbus
scsi	block-5.10-2020-10-24	2020-10-24 12:46:42 -07:00
sfi
sh
siox
slimbus
soc	ARM: Devicetree updates	2020-10-24 10:44:18 -07:00
soundwire
spi	ARM: SoC platform updates	2020-10-24 10:33:08 -07:00
spmi
ssb
staging	mm: remove kzfree() compatibility definition	2020-10-25 11:39:02 -07:00
target	SCSI misc on 20201023	2020-10-23 16:19:02 -07:00
tc
tee
thermal	treewide: Convert macro and uses of __section(foo) to __section("foo")	2020-10-25 14:51:49 -07:00
thunderbolt
tty	vt: keyboard, extend func_buf_lock to readers	2020-10-28 13:41:02 +01:00
uio
usb	ARM: SoC platform updates	2020-10-24 10:33:08 -07:00
vdpa	vhost,vdpa,virtio: cleanups, fixes	2020-10-23 11:00:57 -07:00
vfio	VFIO updates for v5.10-rc1	2020-10-22 13:00:44 -07:00
vhost	vhost_vdpa: remove unnecessary spin_lock in vhost_vring_call	2020-10-21 10:48:10 -04:00
video	ARM: SoC platform updates	2020-10-24 10:33:08 -07:00
virt
virtio	vhost,vdpa,virtio: cleanups, fixes	2020-10-23 11:00:57 -07:00
visorbus
vlynq
vme
w1	w1: w1_therm: make w1_poll_completion static	2020-10-05 14:49:24 +02:00
watchdog	ARM: SoC platform updates	2020-10-24 10:33:08 -07:00
xen	xen: branch for v5.10-rc1c	2020-10-25 10:55:35 -07:00
zorro
Kconfig
Makefile