linux-kernel - Re: [PATCH] tty/n_hdlc: fix sleep in !TASK

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <62FAC6A3-AC41-44CD-8ABC-79F404BF8CB1@microgate.com>
Date:   Mon, 31 Dec 2018 19:13:34 -0800
From:   Paul Fulghum <paulkf@...rogate.com>
To:     Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
Cc:     Arnd Bergmann <arnd@...db.de>, Alan Cox <alan@...rguk.ukuu.org.uk>,
        syzbot <syzbot+c244af085a0159d22879@...kaller.appspotmail.com>,
        gregkh@...uxfoundation.org, jslaby@...e.com,
        linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Re: [PATCH] tty/n_hdlc: fix sleep in !TASK_RUNNING state warning



On Dec 31, 2018, at 7:11 PM, Paul Fulghum <paulkf@...rogate.com> wrote:

NAK to this patch. It causes lost wakeups in both read and write paths.

The write path does not need changing.

The read path can be fixed by setting current to TASK_RUNNING at the top of the if (rbuf) block so the warning is not triggered by copy_to_user(). If this block runs the condition is satisfied and it breaks out of the polling loop where it is already being set to TASK_RUNNING and removed from the wait queue. This particular path just needs to account for the copy_to_user which occurs before breaking out.

I’ll make a patch to do this when I have the ability to test it in a day or two.


> On Dec 29, 2018, at 3:48 AM, Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp> wrote:
> 
> syzbot is hitting __might_sleep() warning [1], for commit 1035b63d3c6fc34a
> ("n_hdlc: fix read and write locking") changed to set TASK_INTERRUPTIBLE
> state before calling copy_to_user(). Let's set TASK_INTERRUPTIBLE state
> immediately before calling schedule().
> 
> [1] https://syzkaller.appspot.com/bug?id=17d5de7f1fcab794cb8c40032f893f52de899324
> 
> Signed-off-by: Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
> Reported-by: syzbot <syzbot+c244af085a0159d22879@...kaller.appspotmail.com>
> Cc: Paul Fulghum <paulkf@...rogate.com>
> Cc: Arnd Bergmann <arnd@...db.de>
> Cc: Alan Cox <alan@...rguk.ukuu.org.uk>
> ---
> drivers/tty/n_hdlc.c | 7 +++----
> 1 file changed, 3 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/tty/n_hdlc.c b/drivers/tty/n_hdlc.c
> index dabb391..7835489 100644
> --- a/drivers/tty/n_hdlc.c
> +++ b/drivers/tty/n_hdlc.c
> @@ -589,8 +589,6 @@ static ssize_t n_hdlc_tty_read(struct tty_struct *tty, struct file *file,
> 		if (tty_hung_up_p(file))
> 			break;
> 
> -		set_current_state(TASK_INTERRUPTIBLE);
> -
> 		rbuf = n_hdlc_buf_get(&n_hdlc->rx_buf_list);
> 		if (rbuf) {
> 			if (rbuf->count > nr) {
> @@ -617,6 +615,7 @@ static ssize_t n_hdlc_tty_read(struct tty_struct *tty, struct file *file,
> 			break;
> 		}
> 
> +		set_current_state(TASK_INTERRUPTIBLE);
> 		schedule();
> 
> 		if (signal_pending(current)) {
> @@ -673,8 +672,6 @@ static ssize_t n_hdlc_tty_write(struct tty_struct *tty, struct file *file,
> 	add_wait_queue(&tty->write_wait, &wait);
> 
> 	for (;;) {
> -		set_current_state(TASK_INTERRUPTIBLE);
> -	
> 		tbuf = n_hdlc_buf_get(&n_hdlc->tx_free_buf_list);
> 		if (tbuf)
> 			break;
> @@ -683,6 +680,8 @@ static ssize_t n_hdlc_tty_write(struct tty_struct *tty, struct file *file,
> 			error = -EAGAIN;
> 			break;
> 		}
> +
> +		set_current_state(TASK_INTERRUPTIBLE);
> 		schedule();
> 			
> 		n_hdlc = tty2n_hdlc (tty);
> -- 
> 1.8.3.1
> 
> 

--
Paul Fulghum
MicroGate Systems, Ltd.
=Customer Driven, by Design=
(512) 345-7791 x102 (Voice)
(512) 343-9046 (Fax)
Central Time Zone (GMT -5h)
www.microgate.com