All of lore.kernel.org
 help / color / mirror / Atom feed
From: Jiri Slaby <jslaby@suse.cz>
To: Dmitry Safonov <dima@arista.com>, linux-kernel@vger.kernel.org
Cc: "Daniel Axtens" <dja@axtens.net>,
	"Dmitry Safonov" <0x7f454c46@gmail.com>,
	"Sergey Senozhatsky" <sergey.senozhatsky.work@gmail.com>,
	"Dmitry Vyukov" <dvyukov@google.com>,
	"Nathan March" <nathan@gt.net>,
	"Tan Xiaojun" <tanxiaojun@huawei.com>,
	"Peter Hurley" <peter@hurleysoftware.com>,
	"Tetsuo Handa" <penguin-kernel@i-love.sakura.ne.jp>,
	"Pasi Kärkkäinen" <pasik@iki.fi>,
	"Greg Kroah-Hartman" <gregkh@linuxfoundation.org>,
	"Michael Neuling" <mikey@neuling.org>,
	"Mikulas Patocka" <mpatocka@redhat.com>,
	syzbot+3aa9784721dfb90e984d@syzkaller.appspotmail.com,
	stable@vger.kernel.org
Subject: Re: [PATCHv2 2/4] tty: Hold tty_ldisc_lock() during tty_reopen()
Date: Tue, 4 Sep 2018 11:02:12 +0200	[thread overview]
Message-ID: <6a2acb53-7dfc-9426-b277-4368a6d2a2e8@suse.cz> (raw)
In-Reply-To: <20180903165257.29227-3-dima@arista.com>

On 09/03/2018, 06:52 PM, Dmitry Safonov wrote:
> tty_ldisc_reinit() doesn't race with neither tty_ldisc_hangup()
> nor set_ldisc() nor tty_ldisc_release() as they use tty lock.
> But it races with anyone who expects line discipline to be the same
> after hoding read semaphore in tty_ldisc_ref().
> 
> We've seen the following crash on v4.9.108 stable:
> 
> BUG: unable to handle kernel paging request at 0000000000002260
> IP: [..] n_tty_receive_buf_common+0x5f/0x86d
> Workqueue: events_unbound flush_to_ldisc
> Call Trace:
>  [..] n_tty_receive_buf2
>  [..] tty_ldisc_receive_buf
>  [..] flush_to_ldisc
>  [..] process_one_work
>  [..] worker_thread
>  [..] kthread
>  [..] ret_from_fork
> 
> tty_ldisc_reinit() should be called with ldisc_sem hold for writing,
> which will protect any reader against line discipline changes.
> 
> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Cc: Jiri Slaby <jslaby@suse.com>

Reviewed-by: Jiri Slaby <jslaby@suse.cz>

> Cc: stable@vger.kernel.org # depends on commit b027e2298bd5 ("tty: fix
> data race between tty_init_dev and flush of buf")
> Reported-by: syzbot+3aa9784721dfb90e984d@syzkaller.appspotmail.com
> Tested-by: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
> Signed-off-by: Dmitry Safonov <dima@arista.com>

thanks,
-- 
js
suse labs

  parent reply	other threads:[~2018-09-04  9:02 UTC|newest]

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-09-03 16:52 [PATCHv2 0/4] tty: Hold write ldisc sem in tty_reopen() Dmitry Safonov
2018-09-03 16:52 ` [PATCHv2 1/4] tty: Drop tty->count on tty_reopen() failure Dmitry Safonov
2018-09-04  8:58   ` Jiri Slaby
2018-09-03 16:52 ` [PATCHv2 2/4] tty: Hold tty_ldisc_lock() during tty_reopen() Dmitry Safonov
2018-09-04  1:51   ` Sergey Senozhatsky
2018-09-04  6:30     ` Jiri Slaby
2018-09-04  7:06       ` Sergey Senozhatsky
2018-09-04  9:02   ` Jiri Slaby [this message]
2018-09-03 16:52 ` [PATCHv2 3/4] tty/lockdep: Add ldisc_sem asserts Dmitry Safonov
2018-09-03 16:52 ` [PATCHv2 4/4] tty: Simplify tty->count math in tty_reopen() Dmitry Safonov
2018-09-04  9:03   ` Jiri Slaby

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=6a2acb53-7dfc-9426-b277-4368a6d2a2e8@suse.cz \
    --to=jslaby@suse.cz \
    --cc=0x7f454c46@gmail.com \
    --cc=dima@arista.com \
    --cc=dja@axtens.net \
    --cc=dvyukov@google.com \
    --cc=gregkh@linuxfoundation.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mikey@neuling.org \
    --cc=mpatocka@redhat.com \
    --cc=nathan@gt.net \
    --cc=pasik@iki.fi \
    --cc=penguin-kernel@i-love.sakura.ne.jp \
    --cc=peter@hurleysoftware.com \
    --cc=sergey.senozhatsky.work@gmail.com \
    --cc=stable@vger.kernel.org \
    --cc=syzbot+3aa9784721dfb90e984d@syzkaller.appspotmail.com \
    --cc=tanxiaojun@huawei.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.