lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Tue, 9 Apr 2024 15:38:21 +0200
From: Greg KH <gregkh@...uxfoundation.org>
To: Yi Yang <yiyang13@...wei.com>
Cc: jirislaby@...nel.org, linux-kernel@...r.kernel.org,
	linux-serial@...r.kernel.org
Subject: Re: [PATCH v2] tty: vt: selection: fix soft lockup in
 paste_selection()

On Wed, Mar 13, 2024 at 09:45:29AM +0000, Yi Yang wrote:
> Soft lockup occurs when vt device used n_null ldisc, n_null_receivebuf()
> is not implemented in null_ldisc. So tty_ldisc_receive_buf always return
> 0 in paste_selection(), this cause deadloop and cause soft lockup.

Why is a vt using n_null?

What is causing that?

> 
> This can be reproduced as follows:
>   int ldisc = 0x1b; // 0x1b is n_null
>   struct{
>   	char subcode;
>   	struct tiocl_selection sel;
>   } data;
>   date.subcode = TIOCL_SETSEL;
>   data.sel.xs = 0;
>   data.sel.xe = 1;
>   data.sel.ys = 0;
>   data.sel.ye = 1;
>   data.sel.sel_mode = TIOCL_SELCHAR;
>   char bytes[2] = {TIOCL_PASTESEL, 0};
>   open("ttyxx", O_RDWR) // open a vt device
>   ioctl(fd, TIOCSETD, &ldisc) // set ldisc to n_null
>   ioctl(fd, TIOCLINUX, &data.subcode);
>   ioctl(fd, TIOCLINUX, bytes); // cause deadloop
> 
> Fix soft lockup by check receive_buf() and receive_buf2() is NULL.

As you had permissions to do this, why prevent it?

> 
> Signed-off-by: Yi Yang <yiyang13@...wei.com>
> ---
> 
> v2:Change Check Condition.
> 
>  drivers/tty/vt/selection.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/drivers/tty/vt/selection.c b/drivers/tty/vt/selection.c
> index 564341f1a74f..715e111376a7 100644
> --- a/drivers/tty/vt/selection.c
> +++ b/drivers/tty/vt/selection.c
> @@ -397,6 +397,12 @@ int paste_selection(struct tty_struct *tty)
>  	ld = tty_ldisc_ref_wait(tty);
>  	if (!ld)
>  		return -EIO;	/* ldisc was hung up */
> +
> +	/*tty_ldisc_receive_buf() won't do anything and cause deadloop later*/

Comments need to be properly formated.

And I do not understand this comment sorry.

> +	if (!ld->ops->receive_buf && !ld->ops->receive_buf2) {

Why check reciev_buf pointers here?  What is that causing?

This needs to be documented a lot better please.

thanks,

greg k-h

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ