Patch "tty: fix out-of-bounds access in tty_driver_lookup_tty()" has been added to the 5.10-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    tty: fix out-of-bounds access in tty_driver_lookup_tty()

to the 5.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     tty-fix-out-of-bounds-access-in-tty_driver_lookup_tt.patch
and it can be found in the queue-5.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 8cb08bdfd5c8f606d9efb8bf28e0fa2a4f1ef32c
Author: Sven Schnelle <svens@xxxxxxxxxxxxx>
Date:   Fri Dec 9 12:27:36 2022 +0100

    tty: fix out-of-bounds access in tty_driver_lookup_tty()
    
    [ Upstream commit db4df8e9d79e7d37732c1a1b560958e8dadfefa1 ]
    
    When specifying an invalid console= device like console=tty3270,
    tty_driver_lookup_tty() returns the tty struct without checking
    whether index is a valid number.
    
    To reproduce:
    
    qemu-system-x86_64 -enable-kvm -nographic -serial mon:stdio \
    -kernel ../linux-build-x86/arch/x86/boot/bzImage \
    -append "console=ttyS0 console=tty3270"
    
    This crashes with:
    
    [    0.770599] BUG: kernel NULL pointer dereference, address: 00000000000000ef
    [    0.771265] #PF: supervisor read access in kernel mode
    [    0.771773] #PF: error_code(0x0000) - not-present page
    [    0.772609] Oops: 0000 [#1] PREEMPT SMP PTI
    [    0.774878] RIP: 0010:tty_open+0x268/0x6f0
    [    0.784013]  chrdev_open+0xbd/0x230
    [    0.784444]  ? cdev_device_add+0x80/0x80
    [    0.784920]  do_dentry_open+0x1e0/0x410
    [    0.785389]  path_openat+0xca9/0x1050
    [    0.785813]  do_filp_open+0xaa/0x150
    [    0.786240]  file_open_name+0x133/0x1b0
    [    0.786746]  filp_open+0x27/0x50
    [    0.787244]  console_on_rootfs+0x14/0x4d
    [    0.787800]  kernel_init_freeable+0x1e4/0x20d
    [    0.788383]  ? rest_init+0xc0/0xc0
    [    0.788881]  kernel_init+0x11/0x120
    [    0.789356]  ret_from_fork+0x22/0x30
    
    Signed-off-by: Sven Schnelle <svens@xxxxxxxxxxxxx>
    Reviewed-by: Jiri Slaby <jirislaby@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20221209112737.3222509-2-svens@xxxxxxxxxxxxx
    Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 669aef77a0bd0..c37d2657308cd 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -1237,14 +1237,16 @@ static struct tty_struct *tty_driver_lookup_tty(struct tty_driver *driver,
 {
 	struct tty_struct *tty;
 
-	if (driver->ops->lookup)
+	if (driver->ops->lookup) {
 		if (!file)
 			tty = ERR_PTR(-EIO);
 		else
 			tty = driver->ops->lookup(driver, file, idx);
-	else
+	} else {
+		if (idx >= driver->num)
+			return ERR_PTR(-EINVAL);
 		tty = driver->ttys[idx];
-
+	}
 	if (!IS_ERR(tty))
 		tty_kref_get(tty);
 	return tty;