| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <8b875c15ef457eb25dd1984c09d65dcae91bcee3.camel@t-2.net>
Date: Fri, 23 Apr 2021 14:23:46 +0200
From: Samo Pogačnik <samo_pogacnik@....net>
To: Jiri Slaby <jirislaby@...nel.org>,
Tetsuo Handa <penguin-kernel@...ove.sakura.ne.jp>,
Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc: Petr Mladek <pmladek@...e.com>,
Sergey Senozhatsky <sergey.senozhatsky@...il.com>,
Steven Rostedt <rostedt@...dmis.org>,
John Ogness <john.ogness@...utronix.de>,
linux-kernel@...r.kernel.org,
syzkaller-bugs <syzkaller-bugs@...glegroups.com>
Subject: [PATCH] ttyprintk: Add TTY port shutdown callback.
Dne 23.04.2021 (pet) ob 12:28 +0200 je Jiri Slaby napisal(a):
> On 23. 04. 21, 11:55, Samo Pogačnik wrote:
> > Dne 23.04.2021 (pet) ob 06:22 +0200 je Jiri Slaby napisal(a):
> > > On 18. 04. 21, 13:16, Samo Pogačnik wrote:
> > > > Dne 15.04.2021 (čet) ob 09:22 +0900 je Tetsuo Handa napisal(a):
> > > > > syzbot is reporting hung task due to flood of
> > > > >
> > > > > tty_warn(tty, "%s: tty->count = 1 port count = %d\n", __func__,
> > > > > port->count);
> > > > >
> > > > > message [1], for ioctl(TIOCVHANGUP) prevents tty_port_close() from
> > > > > decrementing port->count due to tty_hung_up_p() == true.
> > > > >
> > > > > ----------
> > > > > #include <sys/types.h>
> > > > > #include <sys/stat.h>
> > > > > #include <fcntl.h>
> > > > > #include <sys/ioctl.h>
> > > > > #include <unistd.h>
> > > > >
> > > > > int main(int argc, char *argv[])
> > > > > {
> > > > > int i;
> > > > > int fd[10];
> > > > >
> > > > > for (i = 0; i < 10; i++)
> > > > > fd[i] = open("/dev/ttyprintk", O_WRONLY);
> > > > > ioctl(fd[0], TIOCVHANGUP);
> > > > > for (i = 0; i < 10; i++)
> > > > > close(fd[i]);
> > > > > close(open("/dev/ttyprintk", O_WRONLY));
> > > > > return 0;
> > > > > }
> > > > > ----------
> > > > >
> > > > > When TTY hangup happens, port->count needs to be reset via
> > > > > "struct tty_operations"->hangup callback.
> > > > >
> > > > > [1]
> > > > >
> >
> >
https://syzkaller.appspot.com/bug?id=39ea6caa479af471183997376dc7e90bc7d64a6a
> > > > >
> > > > > Reported-by: syzbot <
> > > > > syzbot+43e93968b964e369db0b@...kaller.appspotmail.com
> > > > > >
> > > > >
> > > > > Reported-by: syzbot <
> > > > > syzbot+3ed715090790806d8b18@...kaller.appspotmail.com
> > > > > >
> > > > >
> > > > > Tested-by: syzbot <
> > > > > syzbot+43e93968b964e369db0b@...kaller.appspotmail.com>
> > > > > Signed-off-by: Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
> > > > > Fixes: 24b4b67d17c308aa ("add ttyprintk driver")
> > > > > ---
> > > > > drivers/char/ttyprintk.c | 11 +++++++++++
> > > > > 1 file changed, 11 insertions(+)
> > > > >
> > > > > diff --git a/drivers/char/ttyprintk.c b/drivers/char/ttyprintk.c
> > > > > index 6a0059e508e3..93f5d11c830b 100644
> > > > > --- a/drivers/char/ttyprintk.c
> > > > > +++ b/drivers/char/ttyprintk.c
> > > > > @@ -158,12 +158,23 @@ static int tpk_ioctl(struct tty_struct *tty,
> > > > > return 0;
> > > > > }
> > > > >
> > > > > +/*
> > > > > + * TTY operations hangup function.
> > > > > + */
> > > > > +static void tpk_hangup(struct tty_struct *tty)
> > > > > +{
> > > > > + struct ttyprintk_port *tpkp = tty->driver_data;
> > > > > +
> > > > > + tty_port_hangup(&tpkp->port);
> > > > > +}
> > > > > +
> > > > > static const struct tty_operations ttyprintk_ops = {
> > > > > .open = tpk_open,
> > > > > .close = tpk_close,
> > > > > .write = tpk_write,
> > > > > .write_room = tpk_write_room,
> > > > > .ioctl = tpk_ioctl,
> > > > > + .hangup = tpk_hangup,
> > > > > };
> > > > >
> > > > > static const struct tty_port_operations null_ops = { };
> > > >
> > > > Using the supplied test code, i've tested the patch on my desktop
> > > > running
> > > > the
> > > > 5.4 kernel. After applying the patch, the kernel warnings like
> > > > "ttyprintk:
> > > > tty_port_close_start: tty->count = 1 port count = 11" do not appear any
> > > > more,
> > > > when the test code is run.
> > > > I think the patch is ok.
> > >
> > > I wonder if the buffer shouldn't be flushed in hangup too? Or better,
> > > the flush moved from tty_ops->close to tty_port->ops->shutdown?
> > >
> > > thanks,
> >
> > Good point. I tried the following additional change, which seems to do the
> > trick. What do you think?
> >
> > thanks, Samo
> > ---
> > drivers/char/ttyprintk.c | 26 ++++++++++++++++++--------
> > 1 file changed, 18 insertions(+), 8 deletions(-)
> >
> > diff --git a/drivers/char/ttyprintk.c b/drivers/char/ttyprintk.c
> > index 93f5d11c8..420222a92 100644
> > --- a/drivers/char/ttyprintk.c
> > +++ b/drivers/char/ttyprintk.c
> > @@ -100,12 +100,6 @@ static int tpk_open(struct tty_struct *tty, struct file
> > *filp)
> > static void tpk_close(struct tty_struct *tty, struct file *filp)
> > {
> > struct ttyprintk_port *tpkp = tty->driver_data;
> > - unsigned long flags;
> > -
> > - spin_lock_irqsave(&tpkp->spinlock, flags);
> > - /* flush tpk_printk buffer */
> > - tpk_printk(NULL, 0);
>
> And now, you can drop NULL buf handling from tpk_printk, right?
Exactly!
thanks, Samo
---
drivers/char/ttyprintk.c | 31 ++++++++++++++++++-------------
1 file changed, 18 insertions(+), 13 deletions(-)
diff --git a/drivers/char/ttyprintk.c b/drivers/char/ttyprintk.c
index 93f5d11c8..6f616cb7c 100644
--- a/drivers/char/ttyprintk.c
+++ b/drivers/char/ttyprintk.c
@@ -54,11 +54,6 @@ static int tpk_printk(const unsigned char *buf, int count)
{
int i = tpk_curr;
- if (buf == NULL) {
- tpk_flush();
- return i;
- }
-
for (i = 0; i < count; i++) {
if (tpk_curr >= TPK_STR_SIZE) {
/* end of tmp buffer reached: cut the message in two */
@@ -100,12 +95,6 @@ static int tpk_open(struct tty_struct *tty, struct file
*filp)
static void tpk_close(struct tty_struct *tty, struct file *filp)
{
struct ttyprintk_port *tpkp = tty->driver_data;
- unsigned long flags;
-
- spin_lock_irqsave(&tpkp->spinlock, flags);
- /* flush tpk_printk buffer */
- tpk_printk(NULL, 0);
- spin_unlock_irqrestore(&tpkp->spinlock, flags);
tty_port_close(&tpkp->port, tty, filp);
}
@@ -168,6 +157,20 @@ static void tpk_hangup(struct tty_struct *tty)
tty_port_hangup(&tpkp->port);
}
+/*
+ * TTY port operations shutdown function.
+ */
+static void tpk_port_shutdown(struct tty_port *tport)
+{
+ struct ttyprintk_port *tpkp =
+ container_of(tport, struct ttyprintk_port, port);
+ unsigned long flags;
+
+ spin_lock_irqsave(&tpkp->spinlock, flags);
+ tpk_flush();
+ spin_unlock_irqrestore(&tpkp->spinlock, flags);
+}
+
static const struct tty_operations ttyprintk_ops = {
.open = tpk_open,
.close = tpk_close,
@@ -177,7 +180,9 @@ static const struct tty_operations ttyprintk_ops = {
.hangup = tpk_hangup,
};
-static const struct tty_port_operations null_ops = { };
+static const struct tty_port_operations tpk_port_ops = {
+ .shutdown = tpk_port_shutdown,
+};
static struct tty_driver *ttyprintk_driver;
@@ -195,7 +200,7 @@ static int __init ttyprintk_init(void)
return PTR_ERR(ttyprintk_driver);
tty_port_init(&tpk_port.port);
- tpk_port.port.ops = &null_ops;
+ tpk_port.port.ops = &tpk_port_ops;
ttyprintk_driver->driver_name = "ttyprintk";
ttyprintk_driver->name = "ttyprintk";
--
2.17.1
Powered by blists - more mailing lists