hi, On Wed, Jun 15, 2022 at 12:47:20PM +0200, Jiri Slaby wrote: > On 02. 06. 22, 6:48, Jiri Slaby wrote: > > On 02. 06. 22, 4:48, Hillf Danton wrote: > > > On Wed, 1 Jun 2022 21:34:26 +0300 Dan Carpenter wrote: > > > > Hi Greg, Jiri, > > > > > > > > I searched lore.kernel.org and it seemed like CVE-2022-1462 might not > > > > have ever been reported to you? Here is the original email with the > > > > syzkaller reproducer. > > > > > > > > https://seclists.org/oss-sec/2022/q2/155 > > > > > > > > The reporter proposed a fix, but it won't work. Smatch says that some > > > > of the callers are already holding the port->lock. For example, > > > > sci_dma_rx_complete() will deadlock. > > > > > > Hi Dan > > > > > > To erase the deadlock above, we need to add another helper folding > > > tty_insert_flip_string() and tty_flip_buffer_push() into one nutshell, > > > with buf->tail covered by port->lock. > > > > > > The diff attached in effect reverts > > > 71a174b39f10 ("pty: do tty_flip_buffer_push without port->lock in > > > pty_write"). > > > > > > Only for thoughts now. > > > > I think this the likely the best approach. Except few points inlined below. > > > > Another would be to split tty_flip_buffer_push() into two and call only > > the first one (doing smp_store_release()) inside the lock. I tried that > > already, but it looks much worse. > > > > Another would be to add flags to tty_flip_buffer_push(). Like > > ONLY_ADVANCE and ONLY_QUEUE. Call with the first under the lock, the > > second outside. > > > > Ideas, comments? > > Apparently not, so Hillf, could you resend your patch after fixing the > comments below? Any news here? I'm not sure if I missed the followup submission but was not able to find it. Regards, Salvatore
