On 02. 06. 22, 4:48, Hillf Danton wrote:
On Wed, 1 Jun 2022 21:34:26 +0300 Dan Carpenter wrote:
Hi Greg, Jiri,
I searched lore.kernel.org and it seemed like CVE-2022-1462 might not
have ever been reported to you? Here is the original email with the
syzkaller reproducer.
https://seclists.org/oss-sec/2022/q2/155
The reporter proposed a fix, but it won't work. Smatch says that some
of the callers are already holding the port->lock. For example,
sci_dma_rx_complete() will deadlock.
Hi Dan
To erase the deadlock above, we need to add another helper folding
tty_insert_flip_string() and tty_flip_buffer_push() into one nutshell,
with buf->tail covered by port->lock.
The diff attached in effect reverts
71a174b39f10 ("pty: do tty_flip_buffer_push without port->lock in pty_write").
Only for thoughts now.
I think this the likely the best approach. Except few points inlined below.
Another would be to split tty_flip_buffer_push() into two and call only
the first one (doing smp_store_release()) inside the lock. I tried that
already, but it looks much worse.
Another would be to add flags to tty_flip_buffer_push(). Like
ONLY_ADVANCE and ONLY_QUEUE. Call with the first under the lock, the
second outside.
Ideas, comments?
Hillf
+++ b/drivers/tty/pty.c
@@ -116,15 +116,8 @@ static int pty_write(struct tty_struct *
if (tty->flow.stopped)
return 0;
- if (c > 0) {
- spin_lock_irqsave(&to->port->lock, flags);
- /* Stuff the data into the input queue of the other end */
- c = tty_insert_flip_string(to->port, buf, c);
- spin_unlock_irqrestore(&to->port->lock, flags);
- /* And shovel */
- if (c)
- tty_flip_buffer_push(to->port);
- }
+ if (c > 0)
+ c = tty_flip_insert_and_push_buffer(to->port, buf, c);
return c;
}
+++ b/drivers/tty/tty_buffer.c
@@ -554,6 +554,26 @@ void tty_flip_buffer_push(struct tty_por
}
EXPORT_SYMBOL(tty_flip_buffer_push);
+int tty_flip_insert_and_push_buffer(struct tty_port *port, const unsigned char *string, int cnt)
It should be _insert_string_, IMO.
+{
+ struct tty_bufhead *buf = &port->buf;
+ unsigned long flags;
+
+ spin_lock_irqsave(&port->lock, flags);
+ cnt = tty_insert_flip_string(port, string, cnt);
+ if (cnt) {
+ /*
+ * Paired w/ acquire in flush_to_ldisc(); ensures flush_to_ldisc() sees
+ * buffer data.
+ */
+ smp_store_release(&buf->tail->commit, buf->tail->used);
+ }
+ spin_unlock_irqrestore(&port->lock, flags);
+ queue_work(system_unbound_wq, &buf->work);
\n here please.
+ return cnt;
+}
+EXPORT_SYMBOL(tty_flip_insert_and_push_buffer);
No need to export this, right?
thanks,
--
js
suse labs
