linux-kernel - Re: [PATCH 5.10 04/79] tty: n_gsm: avoid call of sleeping functions from atomic context

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20220914123819.GA12582@duo.ucw.cz>
Date:   Wed, 14 Sep 2022 14:38:19 +0200
From:   Pavel Machek <pavel@...x.de>
To:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc:     linux-kernel@...r.kernel.org, stable@...r.kernel.org,
        stable <stable@...nel.org>, Fedor Pchelkin <pchelkin@...ras.ru>,
        Alexey Khoroshilov <khoroshilov@...ras.ru>
Subject: Re: [PATCH 5.10 04/79] tty: n_gsm: avoid call of sleeping functions
 from atomic context

Hi!

> From: Fedor Pchelkin <pchelkin@...ras.ru>
> 
> commit 902e02ea9385373ce4b142576eef41c642703955 upstream.
> 
> Syzkaller reports the following problem:
> 
> BUG: sleeping function called from invalid context at kernel/printk/printk.c:2347
> in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 1105, name: syz-executor423
> 3 locks held by syz-executor423/1105:

Does this happen in 5.10, too? printk locking changed significantly in
recent years.

> The problem happens in the following control flow:
> 
> gsmld_write(...)
> spin_lock_irqsave(&gsm->tx_lock, flags) // taken a spinlock on TX data
>  con_write(...)
>   do_con_write(...)
>    console_lock()
>     might_sleep() // -> bug
> 
> As far as console_lock() might sleep it should not be called with
> spinlock held.

Ok.

> The patch replaces tx_lock spinlock with mutex in order to avoid the
> problem.

Are you sure you can do that? Original code disabled interrupts,
because parts of protected data were accessed from interrupt context,
and you simply removed that protection.

Best regards,
								Pavel
-- 
DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany

Download attachment "signature.asc" of type "application/pgp-signature" (196 bytes)