github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-09 15:12:59 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
fbe2648024
linux/drivers/tty
History
Jiri Slaby b4492f1e74 vt: selection, push sel_lock up 
commit e8c75a30a2 upstream.

sel_lock cannot nest in the console lock. Thanks to syzkaller, the
kernel states firmly:

> WARNING: possible circular locking dependency detected
> 5.6.0-rc3-syzkaller #0 Not tainted
> ------------------------------------------------------
> syz-executor.4/20336 is trying to acquire lock:
> ffff8880a2e952a0 (&tty->termios_rwsem){++++}, at: tty_unthrottle+0x22/0x100 drivers/tty/tty_ioctl.c:136
>
> but task is already holding lock:
> ffffffff89462e70 (sel_lock){+.+.}, at: paste_selection+0x118/0x470 drivers/tty/vt/selection.c:374
>
> which lock already depends on the new lock.
>
> the existing dependency chain (in reverse order) is:
>
> -> #2 (sel_lock){+.+.}:
>        mutex_lock_nested+0x1b/0x30 kernel/locking/mutex.c:1118
>        set_selection_kernel+0x3b8/0x18a0 drivers/tty/vt/selection.c:217
>        set_selection_user+0x63/0x80 drivers/tty/vt/selection.c:181
>        tioclinux+0x103/0x530 drivers/tty/vt/vt.c:3050
>        vt_ioctl+0x3f1/0x3a30 drivers/tty/vt/vt_ioctl.c:364

This is ioctl(TIOCL_SETSEL).
Locks held on the path: console_lock -> sel_lock

> -> #1 (console_lock){+.+.}:
>        console_lock+0x46/0x70 kernel/printk/printk.c:2289
>        con_flush_chars+0x50/0x650 drivers/tty/vt/vt.c:3223
>        n_tty_write+0xeae/0x1200 drivers/tty/n_tty.c:2350
>        do_tty_write drivers/tty/tty_io.c:962 [inline]
>        tty_write+0x5a1/0x950 drivers/tty/tty_io.c:1046

This is write().
Locks held on the path: termios_rwsem -> console_lock

> -> #0 (&tty->termios_rwsem){++++}:
>        down_write+0x57/0x140 kernel/locking/rwsem.c:1534
>        tty_unthrottle+0x22/0x100 drivers/tty/tty_ioctl.c:136
>        mkiss_receive_buf+0x12aa/0x1340 drivers/net/hamradio/mkiss.c:902
>        tty_ldisc_receive_buf+0x12f/0x170 drivers/tty/tty_buffer.c:465
>        paste_selection+0x346/0x470 drivers/tty/vt/selection.c:389
>        tioclinux+0x121/0x530 drivers/tty/vt/vt.c:3055
>        vt_ioctl+0x3f1/0x3a30 drivers/tty/vt/vt_ioctl.c:364

This is ioctl(TIOCL_PASTESEL).
Locks held on the path: sel_lock -> termios_rwsem

> other info that might help us debug this:
>
> Chain exists of:
>   &tty->termios_rwsem --> console_lock --> sel_lock

Clearly. From the above, we have:
 console_lock -> sel_lock
 sel_lock -> termios_rwsem
 termios_rwsem -> console_lock

Fix this by reversing the console_lock -> sel_lock dependency in
ioctl(TIOCL_SETSEL). First, lock sel_lock, then console_lock.

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Reported-by: syzbot+26183d9746e62da329b8@syzkaller.appspotmail.com
Fixes: 07e6124a1a ("vt: selection, close sel_buffer race")
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200228115406.5735-2-jslaby@suse.cz
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-03-11 14:15:03 +01:00
..
hvc powerpc/pseries/hvconsole: Fix stack overread via udbg 2020-01-09 10:19:08 +01:00
ipwireless tty: ipwireless: Fix potential NULL pointer dereference 2020-01-27 14:50:16 +01:00
serdev serdev: ttyport: restore client ops on deregistration 2020-02-28 16:38:49 +01:00
serial serial: 8250_exar: add support for ACCES cards 2020-03-11 14:15:02 +01:00
vt vt: selection, push sel_lock up 2020-03-11 14:15:03 +01:00
amiserial.c tty: replace ->proc_fops with ->proc_show 2018-05-16 07:24:30 +02:00
cyclades.c tty: replace ->proc_fops with ->proc_show 2018-05-16 07:24:30 +02:00
ehv_bytechan.c treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
goldfish.c headers: separate linux/mod_devicetable.h from linux/platform_device.h 2018-07-07 17:52:26 +02:00
isicom.c treewide: kmalloc() -> kmalloc_array() 2018-06-12 16:19:22 -07:00
Kconfig tty: ldisc: add sysctl to prevent autoloading of ldiscs 2019-04-17 08:38:47 +02:00
Makefile tty: remove bfin_jtag_comm and hvc_bfin_jtag drivers 2018-03-26 15:57:24 +02:00
mips_ejtag_fdc.c tty: Remove redundant license text 2017-11-08 13:08:12 +01:00
moxa.c tty: moxa: Add support for CMSPAR 2017-11-28 15:32:33 +01:00
moxa.h tty: moxa: Add support for CMSPAR 2017-11-28 15:32:33 +01:00
mxser.c tty: Remove redundant license text 2017-11-08 13:08:12 +01:00
mxser.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
n_gsm.c Merge 4.17-rc3 into tty-next 2018-04-30 05:14:55 -07:00
n_hdlc.c tty: Don't block on IO when ldisc change is pending 2019-12-13 08:52:28 +01:00
n_null.c tty: Remove redundant license text 2017-11-08 13:08:12 +01:00
n_r3964.c tty: Don't block on IO when ldisc change is pending 2019-12-13 08:52:28 +01:00
n_tracerouter.c tty: Remove redundant license text 2017-11-08 13:08:12 +01:00
n_tracesink.c tty: Remove redundant license text 2017-11-08 13:08:12 +01:00
n_tracesink.h tty: Remove redundant license text 2017-11-08 13:08:12 +01:00
n_tty.c tty: Don't block on IO when ldisc change is pending 2019-12-13 08:52:28 +01:00
nozomi.c tty/nozomi: fix inconsistent indentation 2018-04-25 14:54:26 +02:00
pty.c pty: fix compat ioctls 2019-12-01 09:16:16 +01:00
rocket_int.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
rocket.c tty: rocket: fix incorrect forward declaration of 'rp_init()' 2019-07-10 09:53:44 +02:00
rocket.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
synclink_gt.c tty: synclink_gt: Adjust indentation in several functions 2020-02-24 08:34:47 +01:00
synclink.c tty: replace ->proc_fops with ->proc_show 2018-05-16 07:24:30 +02:00
synclinkmp.c tty: synclinkmp: Adjust indentation in several functions 2020-02-24 08:34:47 +01:00
sysrq.c sysrq: Remove duplicated sysrq message 2020-03-05 16:42:15 +01:00
tty_audit.c audit: eliminate audit_enabled magic number comparison 2018-06-19 10:43:55 -04:00
tty_baudrate.c termios, tty/tty_baudrate.c: fix buffer overrun 2018-11-21 09:19:20 +01:00
tty_buffer.c tty: increase the default flip buffer limit to 2*640K 2019-04-05 22:33:13 +02:00
tty_io.c tty: ldisc: add sysctl to prevent autoloading of ldiscs 2019-04-17 08:38:47 +02:00
tty_ioctl.c tty: add missing const to termios hw-change helper 2018-05-22 10:08:05 +02:00
tty_jobctrl.c tty: add SPDX identifiers to all remaining files in drivers/tty/ 2017-11-08 13:08:12 +01:00
tty_ldisc.c tty: Don't block on IO when ldisc change is pending 2019-12-13 08:52:28 +01:00
tty_ldsem.c tty/ldsem, locking/rwsem: Add missing ACQUIRE to read_failed sleep loop 2019-08-16 10:12:50 +02:00
tty_mutex.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
tty_port.c serdev: ttyport: restore client ops on deregistration 2020-02-28 16:38:49 +01:00
vcc.c tty: vcc: Convert timers to use timer_setup() 2017-11-04 12:01:54 +01:00