linux-kernel - [PATCH 1/2] serial: 8250: Fix autoconfig

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 5 Jun 2015 09:57:40 +0000
From:	Taichi Kageyama <t-kageyama@...jp.nec.com>
To:	"gregkh@...uxfoundation.org" <gregkh@...uxfoundation.org>
CC:	"linux-serial@...r.kernel.org" <linux-serial@...r.kernel.org>,
	"jslaby@...e.cz" <jslaby@...e.cz>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"prarit@...hat.com" <prarit@...hat.com>,
	Naoya Horiguchi <n-horiguchi@...jp.nec.com>
Subject: [PATCH 1/2] serial: 8250: Fix autoconfig_irq() to avoid race
 conditions

The following race conditions can happen if a serial is used as console.
  Case1. CPU_B handles an interrupt from a serial
    autoconfig_irq() fails whether the interrupt is raised or not
    if CPU_B is disabled to handle interrupts for longer than it expects.
  Case2. CPU_B clears UART_IER just after CPU_A sets UART_IER
    A serial may not make an interrupt.
    autoconfig_irq() can fail if the interrupt is not raised.
  Case3. CPU_A sets UART_IER just after CPU_B clears UART_IER
    This is an unexpected behavior for uart_console_write().

  CPU_A [autoconfig_irq]      CPU_B [serial8250_console_write]
  -----------------------------------------------------------------
  probe_irq_on()              spin_lock_irqsave(&port->lock,)
  serial_outp(,UART_IER,0x0f) serial_out(,UART_IER,0)
  udelay(20);                 uart_console_write()
  probe_irq_off()
                              spin_unlock_irqrestore(&port->lock,)
  -----------------------------------------------------------------

If autoconfig_irq() fails, the console doesn't work in interrupt mode,
the mode cannot be changed anymore, and "input overrun"
(which can make operation mistakes) happens easily.
This problem happens with high rate every boot once it occurs
because the boot sequence is always almost same.

Signed-off-by: Taichi Kageyama <t-kageyama@...jp.nec.com>
Cc: Naoya Horiguchi <n-horiguchi@...jp.nec.com>
---
  drivers/tty/serial/8250/8250_core.c |    6 ++++++
  1 files changed, 6 insertions(+), 0 deletions(-)

diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
index 4506e40..6bf31f2 100644
--- a/drivers/tty/serial/8250/8250_core.c
+++ b/drivers/tty/serial/8250/8250_core.c
@@ -1309,6 +1309,9 @@ static void autoconfig_irq(struct uart_8250_port *up)
  	unsigned long irqs;
  	int irq;

+	if (uart_console(port))
+		console_lock();
+
  	if (port->flags & UPF_FOURPORT) {
  		ICP = (port->iobase & 0xfe0) | 0x1f;
  		save_ICP = inb_p(ICP);
@@ -1347,6 +1350,9 @@ static void autoconfig_irq(struct uart_8250_port *up)
  	if (port->flags & UPF_FOURPORT)
  		outb_p(save_ICP, ICP);

+	if (uart_console(port))
+		console_unlock();
+
  	port->irq = (irq > 0) ? irq : 0;
  }

-- 
1.7.1