linux-kernel - Re: [PATCH] tty: vt: check for atomic context in con

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20240121034817.2280-1-hdanton@sina.com>
Date: Sun, 21 Jan 2024 11:48:17 +0800
From: Hillf Danton <hdanton@...a.com>
To: Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
Cc: syzbot <syzbot+06fa1063cca8163ea541@...kaller.appspotmail.com>,
	syzkaller-bugs@...glegroups.com,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Jiri Slaby <jirislaby@...nel.org>,
	Andrew Morton <akpm@...ux-foundation.org>,
	linux-kernel@...r.kernel.org,
	linux-serial <linux-serial@...r.kernel.org>
Subject: Re: [PATCH] tty: vt: check for atomic context in con_write()

On Sat, 20 Jan 2024 19:34:02 +0900 Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
> syzbot is reporting sleep in atomic context, for gsmld_write() is calling
> con_write() with spinlock held and IRQs disabled.

..

> --- a/drivers/tty/vt/vt.c
> +++ b/drivers/tty/vt/vt.c
> @@ -2856,7 +2856,7 @@ static int do_con_write(struct tty_struct *tty, const u8 *buf, int count)
>  	struct vt_notifier_param param;
>  	bool rescan;
>  
> -	if (in_interrupt())
> +	if (in_interrupt() || irqs_disabled())
>  		return count;
>  
>  	console_lock();

Given console_lock(), no sense could be made by calling do_con_write()
with spin lock held at the first place, regardless irq.

> @@ -3314,7 +3314,7 @@ static void con_flush_chars(struct tty_struct *tty)
>  {
>  	struct vc_data *vc;
>  
> -	if (in_interrupt())	/* from flush_to_ldisc */
> +	if (in_interrupt() || irqs_disabled()) /* from flush_to_ldisc */
>  		return;
>  
>  	/* if we race with con_close(), vt may be null */
> -- 
> 2.18.4