linux-kernel - [PATCH] tty: fix data race in tty_ldisc_ref

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20170304124612.66608-1-dvyukov@google.com>
Date:   Sat,  4 Mar 2017 13:46:12 +0100
From:   Dmitry Vyukov <dvyukov@...gle.com>
To:     gregkh@...uxfoundation.org, jslaby@...e.com,
        peter@...leysoftware.com
Cc:     Dmitry Vyukov <dvyukov@...gle.com>, syzkaller@...glegroups.com,
        linux-kernel@...r.kernel.org,
        One Thousand Gnomes <gnomes@...rguk.ukuu.org.uk>
Subject: [PATCH] tty: fix data race in tty_ldisc_ref_wait()

tty_ldisc_ref_wait() checks tty->ldisc under tty->ldisc_sem.
But if ldisc==NULL it releases them sem and reloads
tty->ldisc without holding the sem. This is wrong and
can lead to returning non-NULL ldisc without protection.

Don't reload tty->ldisc second time.

Signed-off-by: Dmitry Vyukov <dvyukov@...gle.com>
Cc: syzkaller@...glegroups.com
Cc: linux-kernel@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc: Jiri Slaby <jslaby@...e.com>
Cc: Peter Hurley <peter@...leysoftware.com>
Cc: One Thousand Gnomes <gnomes@...rguk.ukuu.org.uk>

---

We badly need data race detector.

Found by syzkaller fuzzer as:

general protection fault: 0000 [#1] SMP KASAN
CPU: 2 PID: 5259 Comm: syz-executor2 Not tainted 4.10.0+ #276
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff8800897b0180 task.stack: ffff880049e20000
RIP: 0010:__read_once_size include/linux/compiler.h:254 [inline]
RIP: 0010:atomic64_read arch/x86/include/asm/atomic64_64.h:21 [inline]
RIP: 0010:atomic_long_read include/asm-generic/atomic-long.h:44 [inline]
RIP: 0010:__mutex_trylock_or_owner kernel/locking/mutex.c:82 [inline]
RIP: 0010:__mutex_trylock kernel/locking/mutex.c:123 [inline]
RIP: 0010:mutex_trylock+0x7b/0x2e0 kernel/locking/mutex.c:1177
RSP: 0018:ffff880049e27810 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 0000000000002280 RCX: ffffc90001cd9000
RDX: 0000000000000450 RSI: ffffffff82722e0c RDI: 0000000000002280
RBP: ffff880049e278b8 R08: ffffe8ffffc3c6c0 R09: 0000000000000000
R10: ffff8800897b0180 R11: 0000000000000000 R12: ffff880049e27850
R13: 0000000000002280 R14: 1ffff100093c4f06 R15: ffff88006f1ad580
FS:  00007f150adf2700(0000) GS:ffff880089c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020003fc8 CR3: 00000000490db000 CR4: 00000000000026e0
DR0: 0000000020000000 DR1: 0000000020000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Call Trace:
 n_tty_read+0x8c4/0x14a0 drivers/tty/n_tty.c:2130
 tty_read+0x161/0x240 drivers/tty/tty_io.c:1079
 do_loop_readv_writev fs/read_write.c:715 [inline]
 __do_readv_writev+0x9df/0x10a0 fs/read_write.c:863
 do_readv_writev+0x13f/0x200 fs/read_write.c:893
 vfs_readv+0x84/0xc0 fs/read_write.c:907
 do_readv+0x110/0x2c0 fs/read_write.c:933
 SYSC_readv fs/read_write.c:1020 [inline]
 SyS_readv+0x27/0x30 fs/read_write.c:1017
 entry_SYSCALL_64_fastpath+0x1f/0xc2
RIP: 0033:0x4458d9
RSP: 002b:00007f150adf1b58 EFLAGS: 00000296 ORIG_RAX: 0000000000000013
RAX: ffffffffffffffda RBX: 0000000000000016 RCX: 00000000004458d9
RDX: 0000000000000002 RSI: 000000002001c000 RDI: 0000000000000016
RBP: 00000000006e1720 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000296 R12: 00000000007082a0
R13: 0000000000000000 R14: 00007f150adf29c0 R15: 00007f150adf2700
RIP: __read_once_size include/linux/compiler.h:254 [inline] RSP: ffff880049e27810
RIP: atomic64_read arch/x86/include/asm/atomic64_64.h:21 [inline] RSP: ffff880049e27810
RIP: atomic_long_read include/asm-generic/atomic-long.h:44 [inline] RSP: ffff880049e27810
RIP: __mutex_trylock_or_owner kernel/locking/mutex.c:82 [inline] RSP: ffff880049e27810
RIP: __mutex_trylock kernel/locking/mutex.c:123 [inline] RSP: ffff880049e27810
RIP: mutex_trylock+0x7b/0x2e0 kernel/locking/mutex.c:1177 RSP: ffff880049e27810
---
 drivers/tty/tty_ldisc.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c
index 68947f6de5ad..e4603b09863a 100644
--- a/drivers/tty/tty_ldisc.c
+++ b/drivers/tty/tty_ldisc.c
@@ -271,10 +271,13 @@ const struct file_operations tty_ldiscs_proc_fops = {
 
 struct tty_ldisc *tty_ldisc_ref_wait(struct tty_struct *tty)
 {
+	struct tty_ldisc *ld;
+
 	ldsem_down_read(&tty->ldisc_sem, MAX_SCHEDULE_TIMEOUT);
-	if (!tty->ldisc)
+	ld = tty->ldisc;
+	if (!ld)
 		ldsem_up_read(&tty->ldisc_sem);
-	return tty->ldisc;
+	return ld;
 }
 EXPORT_SYMBOL_GPL(tty_ldisc_ref_wait);
 
-- 
2.12.0.rc1.440.g5b76565f74-goog