On Wed, 1 Jun 2022 21:34:26 +0300 Dan Carpenter wrote: > Hi Greg, Jiri, > > I searched lore.kernel.org and it seemed like CVE-2022-1462 might not > have ever been reported to you? Here is the original email with the > syzkaller reproducer. > > https://seclists.org/oss-sec/2022/q2/155 > > The reporter proposed a fix, but it won't work. Smatch says that some > of the callers are already holding the port->lock. For example, > sci_dma_rx_complete() will deadlock. Hi Dan To erase the deadlock above, we need to add another helper folding tty_insert_flip_string() and tty_flip_buffer_push() into one nutshell, with buf->tail covered by port->lock. The diff attached in effect reverts 71a174b39f10 ("pty: do tty_flip_buffer_push without port->lock in pty_write"). Only for thoughts now. Hillf +++ b/drivers/tty/pty.c @@ -116,15 +116,8 @@ static int pty_write(struct tty_struct * if (tty->flow.stopped) return 0; - if (c > 0) { - spin_lock_irqsave(&to->port->lock, flags); - /* Stuff the data into the input queue of the other end */ - c = tty_insert_flip_string(to->port, buf, c); - spin_unlock_irqrestore(&to->port->lock, flags); - /* And shovel */ - if (c) - tty_flip_buffer_push(to->port); - } + if (c > 0) + c = tty_flip_insert_and_push_buffer(to->port, buf, c); return c; } +++ b/drivers/tty/tty_buffer.c @@ -554,6 +554,26 @@ void tty_flip_buffer_push(struct tty_por } EXPORT_SYMBOL(tty_flip_buffer_push); +int tty_flip_insert_and_push_buffer(struct tty_port *port, const unsigned char *string, int cnt) +{ + struct tty_bufhead *buf = &port->buf; + unsigned long flags; + + spin_lock_irqsave(&port->lock, flags); + cnt = tty_insert_flip_string(port, string, cnt); + if (cnt) { + /* + * Paired w/ acquire in flush_to_ldisc(); ensures flush_to_ldisc() sees + * buffer data. + */ + smp_store_release(&buf->tail->commit, buf->tail->used); + } + spin_unlock_irqrestore(&port->lock, flags); + queue_work(system_unbound_wq, &buf->work); + return cnt; +} +EXPORT_SYMBOL(tty_flip_insert_and_push_buffer); + /** * tty_buffer_init - prepare a tty buffer structure * @port: tty port to initialise
