linux-kernel - Re: [PATCH] ttyprintk: Add TTY hangup callback.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 22 Apr 2021 12:02:31 +0200
From:   Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:     Samo Pogačnik <samo_pogacnik@....net>
Cc:     Tetsuo Handa <penguin-kernel@...ove.sakura.ne.jp>,
        Jiri Slaby <jirislaby@...nel.org>,
        Petr Mladek <pmladek@...e.com>,
        Sergey Senozhatsky <sergey.senozhatsky@...il.com>,
        Steven Rostedt <rostedt@...dmis.org>,
        John Ogness <john.ogness@...utronix.de>,
        linux-kernel@...r.kernel.org,
        syzkaller-bugs <syzkaller-bugs@...glegroups.com>
Subject: Re: [PATCH] ttyprintk: Add TTY hangup callback.

On Sun, Apr 18, 2021 at 01:16:05PM +0200, Samo Pogačnik wrote:
> Dne 15.04.2021 (čet) ob 09:22 +0900 je Tetsuo Handa napisal(a):
> > syzbot is reporting hung task due to flood of
> > 
> >   tty_warn(tty, "%s: tty->count = 1 port count = %d\n", __func__,
> >            port->count);
> > 
> > message [1], for ioctl(TIOCVHANGUP) prevents tty_port_close() from
> > decrementing port->count due to tty_hung_up_p() == true.
> > 
> > ----------
> > #include <sys/types.h>
> > #include <sys/stat.h>
> > #include <fcntl.h>
> > #include <sys/ioctl.h>
> > #include <unistd.h>
> > 
> > int main(int argc, char *argv[])
> > {
> > 	int i;
> > 	int fd[10];
> > 
> > 	for (i = 0; i < 10; i++)
> > 		fd[i] = open("/dev/ttyprintk", O_WRONLY);
> > 	ioctl(fd[0], TIOCVHANGUP);
> > 	for (i = 0; i < 10; i++)
> > 		close(fd[i]);
> > 	close(open("/dev/ttyprintk", O_WRONLY));
> > 	return 0;
> > }
> > ----------
> > 
> > When TTY hangup happens, port->count needs to be reset via
> > "struct tty_operations"->hangup callback.
> > 
> > [1] 
> > https://syzkaller.appspot.com/bug?id=39ea6caa479af471183997376dc7e90bc7d64a6a
> > 
> > Reported-by: syzbot <syzbot+43e93968b964e369db0b@...kaller.appspotmail.com>
> > Reported-by: syzbot <syzbot+3ed715090790806d8b18@...kaller.appspotmail.com>
> > Tested-by: syzbot <syzbot+43e93968b964e369db0b@...kaller.appspotmail.com>
> > Signed-off-by: Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
> > Fixes: 24b4b67d17c308aa ("add ttyprintk driver")
> > ---
> >  drivers/char/ttyprintk.c | 11 +++++++++++
> >  1 file changed, 11 insertions(+)
> > 
> > diff --git a/drivers/char/ttyprintk.c b/drivers/char/ttyprintk.c
> > index 6a0059e508e3..93f5d11c830b 100644
> > --- a/drivers/char/ttyprintk.c
> > +++ b/drivers/char/ttyprintk.c
> > @@ -158,12 +158,23 @@ static int tpk_ioctl(struct tty_struct *tty,
> >  	return 0;
> >  }
> >  
> > +/*
> > + * TTY operations hangup function.
> > + */
> > +static void tpk_hangup(struct tty_struct *tty)
> > +{
> > +	struct ttyprintk_port *tpkp = tty->driver_data;
> > +
> > +	tty_port_hangup(&tpkp->port);
> > +}
> > +
> >  static const struct tty_operations ttyprintk_ops = {
> >  	.open = tpk_open,
> >  	.close = tpk_close,
> >  	.write = tpk_write,
> >  	.write_room = tpk_write_room,
> >  	.ioctl = tpk_ioctl,
> > +	.hangup = tpk_hangup,
> >  };
> >  
> >  static const struct tty_port_operations null_ops = { };
> 
> Using the supplied test code, i've tested the patch on my desktop running the
> 5.4 kernel. After applying the patch, the kernel warnings like "ttyprintk:
> tty_port_close_start: tty->count = 1 port count = 11" do not appear any more,
> when the test code is run.
> I think the patch is ok.

Thanks for the review, I'll go queue this up.

greg k-h