Messages in this thread Patch in this message | ![/](/images/icornerl.gif) | | From | Dmitry Vyukov <> | Subject | [PATCH] tty: fix data race in tty_ldisc_ref_wait() | Date | Sat, 4 Mar 2017 13:46:12 +0100 |
| |
tty_ldisc_ref_wait() checks tty->ldisc under tty->ldisc_sem. But if ldisc==NULL it releases them sem and reloads tty->ldisc without holding the sem. This is wrong and can lead to returning non-NULL ldisc without protection.
Don't reload tty->ldisc second time.
Signed-off-by: Dmitry Vyukov <dvyukov@google.com> Cc: syzkaller@googlegroups.com Cc: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Jiri Slaby <jslaby@suse.com> Cc: Peter Hurley <peter@hurleysoftware.com> Cc: One Thousand Gnomes <gnomes@lxorguk.ukuu.org.uk>
---
We badly need data race detector.
Found by syzkaller fuzzer as:
general protection fault: 0000 [#1] SMP KASAN CPU: 2 PID: 5259 Comm: syz-executor2 Not tainted 4.10.0+ #276 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 task: ffff8800897b0180 task.stack: ffff880049e20000 RIP: 0010:__read_once_size include/linux/compiler.h:254 [inline] RIP: 0010:atomic64_read arch/x86/include/asm/atomic64_64.h:21 [inline] RIP: 0010:atomic_long_read include/asm-generic/atomic-long.h:44 [inline] RIP: 0010:__mutex_trylock_or_owner kernel/locking/mutex.c:82 [inline] RIP: 0010:__mutex_trylock kernel/locking/mutex.c:123 [inline] RIP: 0010:mutex_trylock+0x7b/0x2e0 kernel/locking/mutex.c:1177 RSP: 0018:ffff880049e27810 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: 0000000000002280 RCX: ffffc90001cd9000 RDX: 0000000000000450 RSI: ffffffff82722e0c RDI: 0000000000002280 RBP: ffff880049e278b8 R08: ffffe8ffffc3c6c0 R09: 0000000000000000 R10: ffff8800897b0180 R11: 0000000000000000 R12: ffff880049e27850 R13: 0000000000002280 R14: 1ffff100093c4f06 R15: ffff88006f1ad580 FS: 00007f150adf2700(0000) GS:ffff880089c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020003fc8 CR3: 00000000490db000 CR4: 00000000000026e0 DR0: 0000000020000000 DR1: 0000000020000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Call Trace: n_tty_read+0x8c4/0x14a0 drivers/tty/n_tty.c:2130 tty_read+0x161/0x240 drivers/tty/tty_io.c:1079 do_loop_readv_writev fs/read_write.c:715 [inline] __do_readv_writev+0x9df/0x10a0 fs/read_write.c:863 do_readv_writev+0x13f/0x200 fs/read_write.c:893 vfs_readv+0x84/0xc0 fs/read_write.c:907 do_readv+0x110/0x2c0 fs/read_write.c:933 SYSC_readv fs/read_write.c:1020 [inline] SyS_readv+0x27/0x30 fs/read_write.c:1017 entry_SYSCALL_64_fastpath+0x1f/0xc2 RIP: 0033:0x4458d9 RSP: 002b:00007f150adf1b58 EFLAGS: 00000296 ORIG_RAX: 0000000000000013 RAX: ffffffffffffffda RBX: 0000000000000016 RCX: 00000000004458d9 RDX: 0000000000000002 RSI: 000000002001c000 RDI: 0000000000000016 RBP: 00000000006e1720 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000296 R12: 00000000007082a0 R13: 0000000000000000 R14: 00007f150adf29c0 R15: 00007f150adf2700 RIP: __read_once_size include/linux/compiler.h:254 [inline] RSP: ffff880049e27810 RIP: atomic64_read arch/x86/include/asm/atomic64_64.h:21 [inline] RSP: ffff880049e27810 RIP: atomic_long_read include/asm-generic/atomic-long.h:44 [inline] RSP: ffff880049e27810 RIP: __mutex_trylock_or_owner kernel/locking/mutex.c:82 [inline] RSP: ffff880049e27810 RIP: __mutex_trylock kernel/locking/mutex.c:123 [inline] RSP: ffff880049e27810 RIP: mutex_trylock+0x7b/0x2e0 kernel/locking/mutex.c:1177 RSP: ffff880049e27810 --- drivers/tty/tty_ldisc.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c index 68947f6de5ad..e4603b09863a 100644 --- a/drivers/tty/tty_ldisc.c +++ b/drivers/tty/tty_ldisc.c @@ -271,10 +271,13 @@ const struct file_operations tty_ldiscs_proc_fops = { struct tty_ldisc *tty_ldisc_ref_wait(struct tty_struct *tty) { + struct tty_ldisc *ld; + ldsem_down_read(&tty->ldisc_sem, MAX_SCHEDULE_TIMEOUT); - if (!tty->ldisc) + ld = tty->ldisc; + if (!ld) ldsem_up_read(&tty->ldisc_sem); - return tty->ldisc; + return ld; } EXPORT_SYMBOL_GPL(tty_ldisc_ref_wait); -- 2.12.0.rc1.440.g5b76565f74-goog
| ![\](/images/icornerr.gif) |