linux-kernel - Ping: [PATCH] tty: vt: Fix soft lockup in fbcon cursor blink timer.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Tue, 14 Jun 2016 09:22:39 -0700
From:	David Daney <ddaney@...iumnetworks.com>
To:	Greg Kroah-Hartman <gregkh@...uxfoundation.org>
CC:	Jiri Slaby <jslaby@...e.com>,
	Peter Hurley <peter@...leysoftware.com>,
	Ming Lei <ming.lei@...onical.com>,
	Dann Frazier <dann.frazier@...onical.com>,
	Scot Doyle <lkml14@...tdoyle.com>,
	David Airlie <airlied@...ux.ie>,
	<dri-devel@...ts.freedesktop.org>,
	<Radha.Chintakuntla@...iumnetworks.com>,
	Pavel Machek <pavel@....cz>, <linux-kernel@...r.kernel.org>,
	David Daney <david.daney@...ium.com>, <stable@...r.kernel.org>
Subject: Ping: [PATCH] tty: vt: Fix soft lockup in fbcon cursor blink timer.

Greg et al.,

Now that the merge window is closed, please consider this patch.

Thanks in advance,
David Daney


On 05/17/2016 11:41 AM, David Daney wrote:
> From: David Daney <david.daney@...ium.com>
>
> We are getting somewhat random soft lockups with this signature:
>
> [   86.992215] [<fffffc00080935e0>] el1_irq+0xa0/0x10c
> [   86.997082] [<fffffc000841822c>] cursor_timer_handler+0x30/0x54
> [   87.002991] [<fffffc000810ec44>] call_timer_fn+0x54/0x1a8
> [   87.008378] [<fffffc000810ef88>] run_timer_softirq+0x1c4/0x2bc
> [   87.014200] [<fffffc000809077c>] __do_softirq+0x114/0x344
> [   87.019590] [<fffffc00080af45c>] irq_exit+0x74/0x98
> [   87.024458] [<fffffc00080fac20>] __handle_domain_irq+0x98/0xfc
> [   87.030278] [<fffffc000809056c>] gic_handle_irq+0x94/0x190
>
> This is caused by the vt visual_init() function calling into
> fbcon_init() with a vc_cur_blink_ms value of zero.  This is a
> transient condition, as it is later set to a non-zero value.  But, if
> the timer happens to expire while the blink rate is zero, it goes into
> an endless loop, and we get soft lockup.
>
> The fix is to initialize vc_cur_blink_ms before calling the con_init()
> function.
>
> Signed-off-by: David Daney <david.daney@...ium.com>
> Cc: stable@...r.kernel.org
> ---
>   drivers/tty/vt/vt.c | 1 +
>   1 file changed, 1 insertion(+)
>
> diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
> index 3e3c757..eef5c36 100644
> --- a/drivers/tty/vt/vt.c
> +++ b/drivers/tty/vt/vt.c
> @@ -750,6 +750,7 @@ static void visual_init(struct vc_data *vc, int num, int init)
>   	vc->vc_complement_mask = 0;
>   	vc->vc_can_do_color = 0;
>   	vc->vc_panic_force_write = false;
> +	vc->vc_cur_blink_ms = DEFAULT_CURSOR_BLINK_MS;
>   	vc->vc_sw->con_init(vc, init);
>   	if (!vc->vc_complement_mask)
>   		vc->vc_complement_mask = vc->vc_can_do_color ? 0x7700 : 0x0800;
>