[PATCH] vt: defer kfree() of vc_screenbuf in vc_do_resize()

[Tetsuo Handa]

Do you think this approach is acceptable? Or, do we need to modify set_origin() ?

On 2020/07/29 23:57, Tetsuo Handa wrote:
> syzbot is reporting UAF bug in set_origin() from vc_do_resize() [1], for
> vc_do_resize() calls kfree(vc->vc_screenbuf) before calling set_origin().
> 
> Unfortunately, in set_origin(), vc->vc_sw->con_set_origin() might access
> vc->vc_pos when scroll is involved in order to manipulate cursor, but
> vc->vc_pos refers already released vc->vc_screenbuf until vc->vc_pos gets
> updated based on the result of vc->vc_sw->con_set_origin().
> 
> Preserving old buffer and tolerating outdated vc members until set_origin()
> completes would be easier than preventing vc->vc_sw->con_set_origin() from
> accessing outdated vc members.
> 
> [1] https://syzkaller.appspot.com/bug?id=6649da2081e2ebdc65c0642c214b27fe91099db3
> 
> Reported-by: syzbot <syzbot+9116ecc1978ca3a12f43 at syzkaller.appspotmail.com>
> Signed-off-by: Tetsuo Handa <penguin-kernel at I-love.SAKURA.ne.jp>
> ---
>  drivers/tty/vt/vt.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
> index 42d8c67..c9ee8e9 100644
> --- a/drivers/tty/vt/vt.c
> +++ b/drivers/tty/vt/vt.c
> @@ -1196,7 +1196,7 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc,
>  	unsigned int old_rows, old_row_size, first_copied_row;
>  	unsigned int new_cols, new_rows, new_row_size, new_screen_size;
>  	unsigned int user;
> -	unsigned short *newscreen;
> +	unsigned short *oldscreen, *newscreen;
>  	struct uni_screen *new_uniscr = NULL;
>  
>  	WARN_CONSOLE_UNLOCKED();
> @@ -1294,10 +1294,11 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc,
>  	if (new_scr_end > new_origin)
>  		scr_memsetw((void *)new_origin, vc->vc_video_erase_char,
>  			    new_scr_end - new_origin);
> -	kfree(vc->vc_screenbuf);
> +	oldscreen = vc->vc_screenbuf;
>  	vc->vc_screenbuf = newscreen;
>  	vc->vc_screenbuf_size = new_screen_size;
>  	set_origin(vc);
> +	kfree(oldscreen);
>  
>  	/* do part of a reset_terminal() */
>  	vc->vc_top = 0;
>