lkml.org 
[lkml]   [2018]   [Feb]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 191/195] devpts: fix error handling in devpts_mntget()
    Date
    4.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Eric Biggers <ebiggers@google.com>

    commit c9cc8d01fb04117928830449388512a5047569c9 upstream.

    If devpts_ptmx_path() returns an error code, then devpts_mntget()
    dereferences an ERR_PTR():

    BUG: unable to handle kernel paging request at fffffffffffffff5
    IP: devpts_mntget+0x13f/0x280 fs/devpts/inode.c:173

    Fix it by returning early in the error paths.

    Reproducer:

    #define _GNU_SOURCE
    #include <fcntl.h>
    #include <sched.h>
    #include <sys/ioctl.h>
    #define TIOCGPTPEER _IO('T', 0x41)

    int main()
    {
    for (;;) {
    int fd = open("/dev/ptmx", 0);
    unshare(CLONE_NEWNS);
    ioctl(fd, TIOCGPTPEER, 0);
    }
    }

    Fixes: 311fc65c9fb9 ("pty: Repair TIOCGPTPEER")
    Reported-by: syzbot <syzkaller@googlegroups.com>
    Signed-off-by: Eric Biggers <ebiggers@google.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    fs/devpts/inode.c | 4 ++--
    1 file changed, 2 insertions(+), 2 deletions(-)

    --- a/fs/devpts/inode.c
    +++ b/fs/devpts/inode.c
    @@ -168,11 +168,11 @@ struct vfsmount *devpts_mntget(struct fi
    dput(path.dentry);
    if (err) {
    mntput(path.mnt);
    - path.mnt = ERR_PTR(err);
    + return ERR_PTR(err);
    }
    if (DEVPTS_SB(path.mnt->mnt_sb) != fsi) {
    mntput(path.mnt);
    - path.mnt = ERR_PTR(-ENODEV);
    + return ERR_PTR(-ENODEV);
    }
    return path.mnt;
    }

    \
     
     \ /
      Last update: 2018-02-15 18:06    [W:2.279 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site