From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-wm0-f66.google.com ([74.125.82.66]:52956 "EHLO mail-wm0-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727537AbeH2Spe (ORCPT ); Wed, 29 Aug 2018 14:45:34 -0400 Subject: Re: [PATCH v2] n_tty: Protect tty->disc_data using refcount. To: Tetsuo Handa , gregkh@linuxfoundation.org Cc: syzkaller-bugs@googlegroups.com, syzbot , linux-fsdevel , linux-kernel@vger.kernel.org, Alexander Viro References: <001a113ed31a122ced0568cc6be1@google.com> <35d649ce-0c22-f839-aa4d-19733bf31a9c@I-love.SAKURA.ne.jp> <83fdde07-2f8e-8d20-30a2-a8f0804a5044@I-love.SAKURA.ne.jp> <8e83cd9a-e28c-a9f4-5f47-98f2046a5dfb@I-love.SAKURA.ne.jp> <021343cd-dc28-9889-7656-e624861bc770@suse.cz> From: Jiri Slaby Message-ID: <9c219c68-f7ab-707e-d74e-0f959b12f2f5@suse.cz> Date: Wed, 29 Aug 2018 16:48:12 +0200 MIME-Version: 1.0 In-Reply-To: <021343cd-dc28-9889-7656-e624861bc770@suse.cz> Content-Type: text/plain; charset=utf-8 Content-Language: en-GB Content-Transfer-Encoding: 7bit Sender: linux-fsdevel-owner@vger.kernel.org List-ID: On 08/29/2018, 03:53 PM, Jiri Slaby wrote: > On 07/24/2018, 05:22 PM, Tetsuo Handa wrote: >> From 118c64e86641a97d44dec39e313a95b12d9bc3b2 Mon Sep 17 00:00:00 2001 >> From: Tetsuo Handa >> Date: Wed, 25 Jul 2018 00:15:18 +0900 >> Subject: [PATCH v2] n_tty: Protect tty->disc_data using refcount. >> >> syzbot is reporting NULL pointer dereference at n_tty_set_termios() [1]. >> This is because ioctl(TIOCVHANGUP) versus ioctl(TCSETS) can race. >> >> Since we don't want to introduce new locking dependency, this patch >> converts "struct n_tty_data *ldata = tty->disc_data;" in individual >> function into a function argument which follows "struct tty *", and >> holds tty->disc_data at each "struct tty_ldisc_ops" hook using refcount >> in order to ensure that memory which contains "struct n_tty_data" will >> not be released while processing individual function. > > This does not look correct and is way too complicated. ioctls should not > be called while changing/killing/hanging/whatever a ldisc. But there is > one missing lock in tty_reopen. > > So does the attached patch helps instead? Which is btw in fact semantically the same as Dmitry's patch: https://lore.kernel.org/lkml/20180829022353.23568-3-dima@arista.com/ > thanks,-- js suse labs