tree 2d45349ae0d558eb17c49bbb91df9fa130827db0
parent 6dafe8d0a47ff3b5320eddcff7ea23888719c88e
author Jann Horn <jannh@google.com> 1606958704 +0100
committer Dexter Rivera <riverade@google.com> 1609267191 +0000

tty: Fix ->pgrp locking in tiocspgrp()

commit 54ffccbf053b5b6ca4f6e45094b942fab92a25fc upstream.

tiocspgrp() takes two tty_struct pointers: One to the tty that userspace
passed to ioctl() (`tty`) and one to the TTY being changed (`real_tty`).
These pointers are different when ioctl() is called with a master fd.

To properly lock real_tty->pgrp, we must take real_tty->ctrl_lock.

This bug makes it possible for racing ioctl(TIOCSPGRP, ...) calls on
both sides of a PTY pair to corrupt the refcount of `struct pid`,
leading to use-after-free errors.

BUG=b/176281470
TEST=presubmit
RELEASE_NOTE=Fixed CVE-2020-29661
SOURCE=UPSTREAM(54ffccbf053b5b6ca4f6e45094b942fab92a25fc)

cos-patch: security-high
Fixes: 47f86834bbd4 ("redo locking of tty->pgrp")
CC: stable@kernel.org
Signed-off-by: Jann Horn <jannh@google.com>
Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/9620
Reviewed-by: Vaibhav Rustagi <vaibhavrustagi@google.com>
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
Signed-off-by: Dexter Rivera <riverade@google.com>
Change-Id: Ida97fd8d7e5e21724e9af173438c144ef7322f96
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/10040
Reviewed-by: Robert Kolchmeyer <rkolchmeyer@google.com>
Reviewed-by: Roy Yang <royyang@google.com>