redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity
alistair23-linux/drivers/tty
History
Jiri Slaby 9a9c13ad21 vt: selection, push sel_lock up 
commit e8c75a30a2 upstream.

sel_lock cannot nest in the console lock. Thanks to syzkaller, the
kernel states firmly:

> WARNING: possible circular locking dependency detected
> 5.6.0-rc3-syzkaller #0 Not tainted
> ------------------------------------------------------
> syz-executor.4/20336 is trying to acquire lock:
> ffff8880a2e952a0 (&tty->termios_rwsem){++++}, at: tty_unthrottle+0x22/0x100 drivers/tty/tty_ioctl.c:136
>
> but task is already holding lock:
> ffffffff89462e70 (sel_lock){+.+.}, at: paste_selection+0x118/0x470 drivers/tty/vt/selection.c:374
>
> which lock already depends on the new lock.
>
> the existing dependency chain (in reverse order) is:
>
> -> #2 (sel_lock){+.+.}:
>        mutex_lock_nested+0x1b/0x30 kernel/locking/mutex.c:1118
>        set_selection_kernel+0x3b8/0x18a0 drivers/tty/vt/selection.c:217
>        set_selection_user+0x63/0x80 drivers/tty/vt/selection.c:181
>        tioclinux+0x103/0x530 drivers/tty/vt/vt.c:3050
>        vt_ioctl+0x3f1/0x3a30 drivers/tty/vt/vt_ioctl.c:364

This is ioctl(TIOCL_SETSEL).
Locks held on the path: console_lock -> sel_lock

> -> #1 (console_lock){+.+.}:
>        console_lock+0x46/0x70 kernel/printk/printk.c:2289
>        con_flush_chars+0x50/0x650 drivers/tty/vt/vt.c:3223
>        n_tty_write+0xeae/0x1200 drivers/tty/n_tty.c:2350
>        do_tty_write drivers/tty/tty_io.c:962 [inline]
>        tty_write+0x5a1/0x950 drivers/tty/tty_io.c:1046

This is write().
Locks held on the path: termios_rwsem -> console_lock

> -> #0 (&tty->termios_rwsem){++++}:
>        down_write+0x57/0x140 kernel/locking/rwsem.c:1534
>        tty_unthrottle+0x22/0x100 drivers/tty/tty_ioctl.c:136
>        mkiss_receive_buf+0x12aa/0x1340 drivers/net/hamradio/mkiss.c:902
>        tty_ldisc_receive_buf+0x12f/0x170 drivers/tty/tty_buffer.c:465
>        paste_selection+0x346/0x470 drivers/tty/vt/selection.c:389
>        tioclinux+0x121/0x530 drivers/tty/vt/vt.c:3055
>        vt_ioctl+0x3f1/0x3a30 drivers/tty/vt/vt_ioctl.c:364

This is ioctl(TIOCL_PASTESEL).
Locks held on the path: sel_lock -> termios_rwsem

> other info that might help us debug this:
>
> Chain exists of:
>   &tty->termios_rwsem --> console_lock --> sel_lock

Clearly. From the above, we have:
 console_lock -> sel_lock
 sel_lock -> termios_rwsem
 termios_rwsem -> console_lock

Fix this by reversing the console_lock -> sel_lock dependency in
ioctl(TIOCL_SETSEL). First, lock sel_lock, then console_lock.

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Reported-by: syzbot+26183d9746e62da329b8@syzkaller.appspotmail.com
Fixes: 07e6124a1a ("vt: selection, close sel_buffer race")
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200228115406.5735-2-jslaby@suse.cz
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 		2020-03-12 13:00:21 +01:00
..
hvc tty: hvcs: Fix odd use of strlcpy 2019-09-04 12:43:44 +02:00
ipwireless tty: add SPDX identifiers to Kconfig and Makefiles 2019-04-04 18:48:43 +02:00
serdev serdev: ttyport: restore client ops on deregistration 2020-02-28 17:22:19 +01:00
serial serial: 8250_exar: add support for ACCES cards 2020-03-12 13:00:20 +01:00
vt vt: selection, push sel_lock up 2020-03-12 13:00:21 +01:00
Kconfig docs: serial: move it to the driver-api 2019-07-15 11:03:03 -03:00
Makefile tty: Add NULL TTY driver 2019-04-16 15:21:34 +02:00
amiserial.c kill TIOCSERGSTRUCT 2018-10-13 00:50:53 -04:00
cyclades.c cyclades: switch to ->[sg]et_serial() 2018-10-13 00:50:30 -04:00
ehv_bytechan.c
…
goldfish.c
…
isicom.c tty/isicom: remove redundant assignment to variable word_count 2019-09-04 12:43:44 +02:00
mips_ejtag_fdc.c
…
moxa.c moxa: switch to ->[sg]et_serial() 2018-10-13 00:50:32 -04:00
moxa.h
…
mxser.c mxser: switch to ->[sg]et_serial() 2018-10-13 00:50:32 -04:00
mxser.h
…
n_gsm.c tty: n_gsm: avoid recursive locking with async port hangup 2019-09-04 12:43:56 +02:00
n_hdlc.c tty: n_hdlc: fix build on SPARC 2019-10-04 15:14:20 +02:00
n_null.c
…
n_r3964.c tty: Don't block on IO when ldisc change is pending 2018-12-05 12:16:33 +01:00
n_tracerouter.c
…
n_tracesink.c
…
n_tracesink.h
…
n_tty.c n_tty: check for negative and zero space return from tty_write_room 2019-04-16 15:21:33 +02:00
nozomi.c tty: nozomi: Use dev_get_drvdata 2019-09-04 12:43:44 +02:00
pty.c Revert "tty: pty: Fix race condition between release_one_tty and pty_write" 2019-03-29 15:47:40 +01:00
rocket.c TTY/Serial patches for 5.2-rc1 2019-05-08 10:07:28 -07:00
rocket.h tty: rocket: Remove RCPK_GET_STRUCT ioctl 2019-04-25 11:58:56 +02:00
rocket_int.h
…
synclink.c tty/synclink: remove ISA support 2019-02-12 08:51:33 +01:00
synclink_gt.c tty: synclink_gt: Adjust indentation in several functions 2020-02-24 08:36:47 +01:00
synclinkmp.c tty: synclinkmp: Adjust indentation in several functions 2020-02-24 08:36:47 +01:00
sysrq.c panic: avoid the extra noise dmesg 2019-05-14 19:52:51 -07:00
tty_audit.c audit: join tty records to their syscall 2019-02-07 21:33:54 -05:00
tty_baudrate.c termios, tty/tty_baudrate.c: fix buffer overrun 2018-11-08 03:36:45 -08:00
tty_buffer.c tty: increase the default flip buffer limit to 2*640K 2019-01-30 12:03:58 +01:00
tty_io.c drivers: Introduce device lookup variants by device type 2019-07-30 13:07:42 +02:00
tty_ioctl.c
…
tty_jobctrl.c tty: fix read of tty->pgrp outside of ctrl_lock 2019-03-28 01:28:23 +09:00
tty_ldisc.c proc/sysctl: add shared variables for range check 2019-07-18 17:08:07 -07:00
tty_ldsem.c tty/ldsem, locking/rwsem: Add missing ACQUIRE to read_failed sleep loop 2019-07-25 15:39:24 +02:00
tty_mutex.c
…
tty_port.c serdev: ttyport: restore client ops on deregistration 2020-02-28 17:22:19 +01:00
ttynull.c tty: Add NULL TTY driver 2019-04-16 15:21:34 +02:00
vcc.c tty: fix up a few remaining files without SPDX identifiers 2019-04-04 18:48:43 +02:00