CVE-2022-1462: race condition vulnerability in drivers/tty/tty_buffers.c

CVE-2022-1462: race condition vulnerability in drivers/tty/tty_buffers.c

[Dan Carpenter]

Hi Greg, Jiri,

I searched lore.kernel.org and it seemed like CVE-2022-1462 might not
have ever been reported to you?  Here is the original email with the
syzkaller reproducer.

https://seclists.org/oss-sec/2022/q2/155

The reporter proposed a fix, but it won't work.  Smatch says that some
of the callers are already holding the port->lock.  For example,
sci_dma_rx_complete() will deadlock.

regards,
dan carpenter

CVE-2022-1462: race condition vulnerability in drivers/tty/tty_buffers.c

[Hillf Danton]

On Wed, 1 Jun 2022 21:34:26 +0300 Dan Carpenter wrote:
> Hi Greg, Jiri,
> 
> I searched lore.kernel.org and it seemed like CVE-2022-1462 might not
> have ever been reported to you?  Here is the original email with the
> syzkaller reproducer.
> 
> https://seclists.org/oss-sec/2022/q2/155
> 
> The reporter proposed a fix, but it won't work.  Smatch says that some
> of the callers are already holding the port->lock.  For example,
> sci_dma_rx_complete() will deadlock.

Hi Dan

To erase the deadlock above, we need to add another helper folding
tty_insert_flip_string() and tty_flip_buffer_push() into one nutshell,
with buf->tail covered by port->lock.

The diff attached in effect reverts
71a174b39f10 ("pty: do tty_flip_buffer_push without port->lock in pty_write").

Only for thoughts now.

Hillf

+++ b/drivers/tty/pty.c
@@ -116,15 +116,8 @@ static int pty_write(struct tty_struct *
 	if (tty->flow.stopped)
 		return 0;
 
-	if (c > 0) {
-		spin_lock_irqsave(&to->port->lock, flags);
-		/* Stuff the data into the input queue of the other end */
-		c = tty_insert_flip_string(to->port, buf, c);
-		spin_unlock_irqrestore(&to->port->lock, flags);
-		/* And shovel */
-		if (c)
-			tty_flip_buffer_push(to->port);
-	}
+	if (c > 0)
+		c = tty_flip_insert_and_push_buffer(to->port, buf, c);
 	return c;
 }
 
+++ b/drivers/tty/tty_buffer.c
@@ -554,6 +554,26 @@ void tty_flip_buffer_push(struct tty_por
 }
 EXPORT_SYMBOL(tty_flip_buffer_push);
 
+int tty_flip_insert_and_push_buffer(struct tty_port *port, const unsigned char *string, int cnt)
+{
+	struct tty_bufhead *buf = &port->buf;
+	unsigned long flags;
+
+	spin_lock_irqsave(&port->lock, flags);
+	cnt = tty_insert_flip_string(port, string, cnt);
+	if (cnt) {
+		/*
+		 * Paired w/ acquire in flush_to_ldisc(); ensures flush_to_ldisc() sees
+		 * buffer data.
+		 */
+		smp_store_release(&buf->tail->commit, buf->tail->used);
+	}
+	spin_unlock_irqrestore(&port->lock, flags);
+	queue_work(system_unbound_wq, &buf->work);
+	return cnt;
+}
+EXPORT_SYMBOL(tty_flip_insert_and_push_buffer);
+
 /**
  * tty_buffer_init		-	prepare a tty buffer structure
  * @port: tty port to initialise

Re: CVE-2022-1462: race condition vulnerability in drivers/tty/tty_buffers.c

[Jiri Slaby]

On 02. 06. 22, 4:48, Hillf Danton wrote:
> On Wed, 1 Jun 2022 21:34:26 +0300 Dan Carpenter wrote:
>> Hi Greg, Jiri,
>>
>> I searched lore.kernel.org and it seemed like CVE-2022-1462 might not
>> have ever been reported to you?  Here is the original email with the
>> syzkaller reproducer.
>>
>> https://seclists.org/oss-sec/2022/q2/155
>>
>> The reporter proposed a fix, but it won't work.  Smatch says that some
>> of the callers are already holding the port->lock.  For example,
>> sci_dma_rx_complete() will deadlock.
> 
> Hi Dan
> 
> To erase the deadlock above, we need to add another helper folding
> tty_insert_flip_string() and tty_flip_buffer_push() into one nutshell,
> with buf->tail covered by port->lock.
> 
> The diff attached in effect reverts
> 71a174b39f10 ("pty: do tty_flip_buffer_push without port->lock in pty_write").
> 
> Only for thoughts now.

I think this the likely the best approach. Except few points inlined below.

Another would be to split tty_flip_buffer_push() into two and call only 
the first one (doing smp_store_release()) inside the lock. I tried that 
already, but it looks much worse.

Another would be to add flags to tty_flip_buffer_push(). Like 
ONLY_ADVANCE and ONLY_QUEUE. Call with the first under the lock, the 
second outside.

Ideas, comments?

> Hillf
> 
> +++ b/drivers/tty/pty.c
> @@ -116,15 +116,8 @@ static int pty_write(struct tty_struct *
>   	if (tty->flow.stopped)
>   		return 0;
>   
> -	if (c > 0) {
> -		spin_lock_irqsave(&to->port->lock, flags);
> -		/* Stuff the data into the input queue of the other end */
> -		c = tty_insert_flip_string(to->port, buf, c);
> -		spin_unlock_irqrestore(&to->port->lock, flags);
> -		/* And shovel */
> -		if (c)
> -			tty_flip_buffer_push(to->port);
> -	}
> +	if (c > 0)
> +		c = tty_flip_insert_and_push_buffer(to->port, buf, c);
>   	return c;
>   }
>   
> +++ b/drivers/tty/tty_buffer.c
> @@ -554,6 +554,26 @@ void tty_flip_buffer_push(struct tty_por
>   }
>   EXPORT_SYMBOL(tty_flip_buffer_push);
>   
> +int tty_flip_insert_and_push_buffer(struct tty_port *port, const unsigned char *string, int cnt)

It should be _insert_string_, IMO.

> +{
> +	struct tty_bufhead *buf = &port->buf;
> +	unsigned long flags;
> +
> +	spin_lock_irqsave(&port->lock, flags);
> +	cnt = tty_insert_flip_string(port, string, cnt);
> +	if (cnt) {
> +		/*
> +		 * Paired w/ acquire in flush_to_ldisc(); ensures flush_to_ldisc() sees
> +		 * buffer data.
> +		 */
> +		smp_store_release(&buf->tail->commit, buf->tail->used);
> +	}
> +	spin_unlock_irqrestore(&port->lock, flags);
> +	queue_work(system_unbound_wq, &buf->work);

\n here please.

> +	return cnt;
> +}
> +EXPORT_SYMBOL(tty_flip_insert_and_push_buffer);

No need to export this, right?

thanks,
-- 
js
suse labs

Re: CVE-2022-1462: race condition vulnerability in drivers/tty/tty_buffers.c

[Jiri Slaby]

On 02. 06. 22, 6:48, Jiri Slaby wrote:
> On 02. 06. 22, 4:48, Hillf Danton wrote:
>> On Wed, 1 Jun 2022 21:34:26 +0300 Dan Carpenter wrote:
>>> Hi Greg, Jiri,
>>>
>>> I searched lore.kernel.org and it seemed like CVE-2022-1462 might not
>>> have ever been reported to you?  Here is the original email with the
>>> syzkaller reproducer.
>>>
>>> https://seclists.org/oss-sec/2022/q2/155
>>>
>>> The reporter proposed a fix, but it won't work.  Smatch says that some
>>> of the callers are already holding the port->lock.  For example,
>>> sci_dma_rx_complete() will deadlock.
>>
>> Hi Dan
>>
>> To erase the deadlock above, we need to add another helper folding
>> tty_insert_flip_string() and tty_flip_buffer_push() into one nutshell,
>> with buf->tail covered by port->lock.
>>
>> The diff attached in effect reverts
>> 71a174b39f10 ("pty: do tty_flip_buffer_push without port->lock in 
>> pty_write").
>>
>> Only for thoughts now.
> 
> I think this the likely the best approach. Except few points inlined below.
> 
> Another would be to split tty_flip_buffer_push() into two and call only 
> the first one (doing smp_store_release()) inside the lock. I tried that 
> already, but it looks much worse.
> 
> Another would be to add flags to tty_flip_buffer_push(). Like 
> ONLY_ADVANCE and ONLY_QUEUE. Call with the first under the lock, the 
> second outside.
> 
> Ideas, comments?

Apparently not, so Hillf, could you resend your patch after fixing the 
comments below?

Thanks.

>> Hillf
>>
>> +++ b/drivers/tty/pty.c
>> @@ -116,15 +116,8 @@ static int pty_write(struct tty_struct *
>>       if (tty->flow.stopped)
>>           return 0;
>> -    if (c > 0) {
>> -        spin_lock_irqsave(&to->port->lock, flags);
>> -        /* Stuff the data into the input queue of the other end */
>> -        c = tty_insert_flip_string(to->port, buf, c);
>> -        spin_unlock_irqrestore(&to->port->lock, flags);
>> -        /* And shovel */
>> -        if (c)
>> -            tty_flip_buffer_push(to->port);
>> -    }
>> +    if (c > 0)
>> +        c = tty_flip_insert_and_push_buffer(to->port, buf, c);
>>       return c;
>>   }
>> +++ b/drivers/tty/tty_buffer.c
>> @@ -554,6 +554,26 @@ void tty_flip_buffer_push(struct tty_por
>>   }
>>   EXPORT_SYMBOL(tty_flip_buffer_push);
>> +int tty_flip_insert_and_push_buffer(struct tty_port *port, const 
>> unsigned char *string, int cnt)
> 
> It should be _insert_string_, IMO.
> 
>> +{
>> +    struct tty_bufhead *buf = &port->buf;
>> +    unsigned long flags;
>> +
>> +    spin_lock_irqsave(&port->lock, flags);
>> +    cnt = tty_insert_flip_string(port, string, cnt);
>> +    if (cnt) {
>> +        /*
>> +         * Paired w/ acquire in flush_to_ldisc(); ensures 
>> flush_to_ldisc() sees
>> +         * buffer data.
>> +         */
>> +        smp_store_release(&buf->tail->commit, buf->tail->used);
>> +    }
>> +    spin_unlock_irqrestore(&port->lock, flags);
>> +    queue_work(system_unbound_wq, &buf->work);
> 
> \n here please.
> 
>> +    return cnt;
>> +}
>> +EXPORT_SYMBOL(tty_flip_insert_and_push_buffer);
> 
> No need to export this, right?
> 
> thanks,


-- 
js
suse labs

Re: CVE-2022-1462: race condition vulnerability in drivers/tty/tty_buffers.c

[Salvatore Bonaccorso]

hi,

On Wed, Jun 15, 2022 at 12:47:20PM +0200, Jiri Slaby wrote:
> On 02. 06. 22, 6:48, Jiri Slaby wrote:
> > On 02. 06. 22, 4:48, Hillf Danton wrote:
> > > On Wed, 1 Jun 2022 21:34:26 +0300 Dan Carpenter wrote:
> > > > Hi Greg, Jiri,
> > > > 
> > > > I searched lore.kernel.org and it seemed like CVE-2022-1462 might not
> > > > have ever been reported to you?  Here is the original email with the
> > > > syzkaller reproducer.
> > > > 
> > > > https://seclists.org/oss-sec/2022/q2/155
> > > > 
> > > > The reporter proposed a fix, but it won't work.  Smatch says that some
> > > > of the callers are already holding the port->lock.  For example,
> > > > sci_dma_rx_complete() will deadlock.
> > > 
> > > Hi Dan
> > > 
> > > To erase the deadlock above, we need to add another helper folding
> > > tty_insert_flip_string() and tty_flip_buffer_push() into one nutshell,
> > > with buf->tail covered by port->lock.
> > > 
> > > The diff attached in effect reverts
> > > 71a174b39f10 ("pty: do tty_flip_buffer_push without port->lock in
> > > pty_write").
> > > 
> > > Only for thoughts now.
> > 
> > I think this the likely the best approach. Except few points inlined below.
> > 
> > Another would be to split tty_flip_buffer_push() into two and call only
> > the first one (doing smp_store_release()) inside the lock. I tried that
> > already, but it looks much worse.
> > 
> > Another would be to add flags to tty_flip_buffer_push(). Like
> > ONLY_ADVANCE and ONLY_QUEUE. Call with the first under the lock, the
> > second outside.
> > 
> > Ideas, comments?
> 
> Apparently not, so Hillf, could you resend your patch after fixing the
> comments below?

Any news here? I'm not sure if I missed the followup submission but
was not able to find it.

Regards,
Salvatore