• J
    vt: selection, handle pending signals in paste_selection · 734874b5
    Jiri Slaby 提交于
    mainline inclusion
    from mainline-v5.6-rc2
    commit 687bff0cd08f790d540cfb7b2349f0d876cdddec
    category: bugfix
    bugzilla: 13690
    CVE: CVE-2020-8648
    
    -------------------------------------------------
    
    When pasting a selection to a vt, the task is set as INTERRUPTIBLE while
    waiting for a tty to unthrottle. But signals are not handled at all.
    Normally, this is not a problem as tty_ldisc_receive_buf receives all
    the goods and a user has no reason to interrupt the task.
    
    There are two scenarios where this matters:
    1) when the tty is throttled and a signal is sent to the process, it
       spins on a CPU until the tty is unthrottled. schedule() does not
       really echedule, but returns immediately, of course.
    2) when the sel_buffer becomes invalid, KASAN prevents any reads from it
       and the loop simply does not proceed and spins forever (causing the
       tty to throttle, but the code never sleeps, the same as above). This
       sometimes happens as there is a race in the sel_buffer handling code.
    
    So add signal handling to this ioctl (TIOCL_PASTESEL) and return -EINTR
    in case a signal is pending.
    Signed-off-by: NJiri Slaby <jslaby@suse.cz>
    Cc: stable <stable@vger.kernel.org>
    Link: https://lore.kernel.org/r/20200210081131.23572-1-jslaby@suse.czSigned-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: NYang Yingliang <yangyingliang@huawei.com>
    Reviewed-by: NHanjun Guo <guohanjun@huawei.com>
    Signed-off-by: NYang Yingliang <yangyingliang@huawei.com>
    734874b5
selection.c 9.4 KB