linux-kernel - Re: [PATCH] ttyprintk: Add TTY hangup callback.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <56763238-c613-e882-a575-75a324d539b1@kernel.org>
Date:   Fri, 23 Apr 2021 12:28:45 +0200
From:   Jiri Slaby <jirislaby@...nel.org>
To:     Samo Pogačnik <samo_pogacnik@....net>,
        Tetsuo Handa <penguin-kernel@...ove.sakura.ne.jp>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc:     Petr Mladek <pmladek@...e.com>,
        Sergey Senozhatsky <sergey.senozhatsky@...il.com>,
        Steven Rostedt <rostedt@...dmis.org>,
        John Ogness <john.ogness@...utronix.de>,
        linux-kernel@...r.kernel.org,
        syzkaller-bugs <syzkaller-bugs@...glegroups.com>
Subject: Re: [PATCH] ttyprintk: Add TTY hangup callback.

On 23. 04. 21, 11:55, Samo Pogačnik wrote:
> Dne 23.04.2021 (pet) ob 06:22 +0200 je Jiri Slaby napisal(a):
>> On 18. 04. 21, 13:16, Samo Pogačnik wrote:
>>> Dne 15.04.2021 (čet) ob 09:22 +0900 je Tetsuo Handa napisal(a):
>>>> syzbot is reporting hung task due to flood of
>>>>
>>>>     tty_warn(tty, "%s: tty->count = 1 port count = %d\n", __func__,
>>>>              port->count);
>>>>
>>>> message [1], for ioctl(TIOCVHANGUP) prevents tty_port_close() from
>>>> decrementing port->count due to tty_hung_up_p() == true.
>>>>
>>>> ----------
>>>> #include <sys/types.h>
>>>> #include <sys/stat.h>
>>>> #include <fcntl.h>
>>>> #include <sys/ioctl.h>
>>>> #include <unistd.h>
>>>>
>>>> int main(int argc, char *argv[])
>>>> {
>>>> 	int i;
>>>> 	int fd[10];
>>>>
>>>> 	for (i = 0; i < 10; i++)
>>>> 		fd[i] = open("/dev/ttyprintk", O_WRONLY);
>>>> 	ioctl(fd[0], TIOCVHANGUP);
>>>> 	for (i = 0; i < 10; i++)
>>>> 		close(fd[i]);
>>>> 	close(open("/dev/ttyprintk", O_WRONLY));
>>>> 	return 0;
>>>> }
>>>> ----------
>>>>
>>>> When TTY hangup happens, port->count needs to be reset via
>>>> "struct tty_operations"->hangup callback.
>>>>
>>>> [1]
>>>>
> https://syzkaller.appspot.com/bug?id=39ea6caa479af471183997376dc7e90bc7d64a6a
>>>>
>>>> Reported-by: syzbot <syzbot+43e93968b964e369db0b@...kaller.appspotmail.com
>>>>>
>>>> Reported-by: syzbot <syzbot+3ed715090790806d8b18@...kaller.appspotmail.com
>>>>>
>>>> Tested-by: syzbot <syzbot+43e93968b964e369db0b@...kaller.appspotmail.com>
>>>> Signed-off-by: Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
>>>> Fixes: 24b4b67d17c308aa ("add ttyprintk driver")
>>>> ---
>>>>    drivers/char/ttyprintk.c | 11 +++++++++++
>>>>    1 file changed, 11 insertions(+)
>>>>
>>>> diff --git a/drivers/char/ttyprintk.c b/drivers/char/ttyprintk.c
>>>> index 6a0059e508e3..93f5d11c830b 100644
>>>> --- a/drivers/char/ttyprintk.c
>>>> +++ b/drivers/char/ttyprintk.c
>>>> @@ -158,12 +158,23 @@ static int tpk_ioctl(struct tty_struct *tty,
>>>>    	return 0;
>>>>    }
>>>>    
>>>> +/*
>>>> + * TTY operations hangup function.
>>>> + */
>>>> +static void tpk_hangup(struct tty_struct *tty)
>>>> +{
>>>> +	struct ttyprintk_port *tpkp = tty->driver_data;
>>>> +
>>>> +	tty_port_hangup(&tpkp->port);
>>>> +}
>>>> +
>>>>    static const struct tty_operations ttyprintk_ops = {
>>>>    	.open = tpk_open,
>>>>    	.close = tpk_close,
>>>>    	.write = tpk_write,
>>>>    	.write_room = tpk_write_room,
>>>>    	.ioctl = tpk_ioctl,
>>>> +	.hangup = tpk_hangup,
>>>>    };
>>>>    
>>>>    static const struct tty_port_operations null_ops = { };
>>>
>>> Using the supplied test code, i've tested the patch on my desktop running
>>> the
>>> 5.4 kernel. After applying the patch, the kernel warnings like "ttyprintk:
>>> tty_port_close_start: tty->count = 1 port count = 11" do not appear any
>>> more,
>>> when the test code is run.
>>> I think the patch is ok.
>>
>> I wonder if the buffer shouldn't be flushed in hangup too? Or better,
>> the flush moved from tty_ops->close to tty_port->ops->shutdown?
>>
>> thanks,
> 
> Good point. I tried the following additional change, which seems to do the
> trick. What do you think?
> 
> thanks, Samo
> ---
>   drivers/char/ttyprintk.c | 26 ++++++++++++++++++--------
>   1 file changed, 18 insertions(+), 8 deletions(-)
> 
> diff --git a/drivers/char/ttyprintk.c b/drivers/char/ttyprintk.c
> index 93f5d11c8..420222a92 100644
> --- a/drivers/char/ttyprintk.c
> +++ b/drivers/char/ttyprintk.c
> @@ -100,12 +100,6 @@ static int tpk_open(struct tty_struct *tty, struct file
> *filp)
>   static void tpk_close(struct tty_struct *tty, struct file *filp)
>   {
>   	struct ttyprintk_port *tpkp = tty->driver_data;
> -	unsigned long flags;
> -
> -	spin_lock_irqsave(&tpkp->spinlock, flags);
> -	/* flush tpk_printk buffer */
> -	tpk_printk(NULL, 0);

And now, you can drop NULL buf handling from tpk_printk, right?

> -	spin_unlock_irqrestore(&tpkp->spinlock, flags);
>   
>   	tty_port_close(&tpkp->port, tty, filp);



-- 
js
suse labs