From: Jiri Slaby <jslaby@suse.com>
To: Eric Biggers <ebiggers@kernel.org>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: linux-kernel@vger.kernel.org, linux-serial@vger.kernel.org,
syzkaller-bugs@googlegroups.com,
Eric Dumazet <edumazet@google.com>,
Nicolas Pitre <nico@fluxnic.net>
Subject: Re: [PATCH v2 2/2] vt: vt_ioctl: fix use-after-free in vt_in_use()
Date: Fri, 20 Mar 2020 14:42:12 +0100 [thread overview]
Message-ID: <e2846610-ae0b-8e50-0fc4-c2cad6b23e9a@suse.com> (raw)
In-Reply-To: <20200318223810.162440-3-ebiggers@kernel.org>
On 18. 03. 20, 23:38, Eric Biggers wrote:
> --- a/drivers/tty/vt/vt_ioctl.c
> +++ b/drivers/tty/vt/vt_ioctl.c
> @@ -43,9 +43,11 @@ bool vt_dont_switch;
>
> static inline bool vt_in_use(unsigned int i)
> {
> - extern struct tty_driver *console_driver;
> + const struct vc_data *vc = vc_cons[i].d;
>
> - return console_driver->ttys[i] && console_driver->ttys[i]->count;
> + WARN_CONSOLE_UNLOCKED();
> +
> + return vc && kref_read(&vc->port.kref) > 1;
> }
>
> static inline bool vt_busy(int i)
> @@ -643,15 +645,16 @@ int vt_ioctl(struct tty_struct *tty,
> struct vt_stat __user *vtstat = up;
> unsigned short state, mask;
>
> - /* Review: FIXME: Console lock ? */
> if (put_user(fg_console + 1, &vtstat->v_active))
> ret = -EFAULT;
> else {
> state = 1; /* /dev/tty0 is always open */
> + console_lock();
Could you comment on this one and the lock below why you added it here?
To me, it seems, we should rather introduce a vt alloc/dealloc lock
protecting cases like this, not console lock. But not now, some time
later. So a comment would help when/once we/I get into it...
The interface (ie. the ioctls) also look weird and racy. Both of them.
Like the "OK, I give you this number, but it might not be correct by
now." kind of thing.
This let me think, who could use this? The answer is many 8-/. openpt,
systemd, sysvinit, didn't check others.
Perhaps we should provide openvt -- analogy of openpty and deprecate
VT_OPENQRY?
With VT_GETSTATE, the situation is more complicated:
sysvinit uses VT_GETSTATE only if TIOCGDEV is not available, so
VT_GETSTATE is actually unneeded there.
systemd uses it to find the current console (vtstat->v_active) and
systemd-logind uses it for spawning autovt on free consoles. That sort
of makes sense...
> for (i = 0, mask = 2; i < MAX_NR_CONSOLES && mask;
> ++i, mask <<= 1)
> if (vt_in_use(i))
> state |= mask;
> + console_unlock();
> ret = put_user(state, &vtstat->v_state);
> }
> break;
> @@ -661,10 +664,11 @@ int vt_ioctl(struct tty_struct *tty,
> * Returns the first available (non-opened) console.
> */
> case VT_OPENQRY:
> - /* FIXME: locking ? - but then this is a stupid API */
> + console_lock();
> for (i = 0; i < MAX_NR_CONSOLES; ++i)
> if (!vt_in_use(i))
> break;
> + console_unlock();
> uival = i < MAX_NR_CONSOLES ? (i+1) : -1;
> goto setint;
>
>
thanks,
--
js
suse labs
next prev parent reply other threads:[~2020-03-20 13:42 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20200318222704.GC2334@sol.localdomain>
2020-03-18 22:38 ` [PATCH v2 0/2] vt: fix some vt_ioctl races Eric Biggers
2020-03-18 22:38 ` [PATCH v2 1/2] vt: vt_ioctl: fix VT_DISALLOCATE freeing in-use virtual console Eric Biggers
2020-03-19 7:36 ` Jiri Slaby
2020-03-20 5:10 ` Eric Biggers
2020-03-20 6:57 ` Greg Kroah-Hartman
2020-03-18 22:38 ` [PATCH v2 2/2] vt: vt_ioctl: fix use-after-free in vt_in_use() Eric Biggers
2020-03-20 13:42 ` Jiri Slaby [this message]
2020-03-20 19:34 ` Eric Biggers
2020-03-22 3:43 ` [PATCH v3 0/2] vt: fix some vt_ioctl races Eric Biggers
2020-03-22 3:43 ` [PATCH v3 1/2] vt: vt_ioctl: fix VT_DISALLOCATE freeing in-use virtual console Eric Biggers
2020-03-27 10:28 ` Jiri Slaby
2020-03-22 3:43 ` [PATCH v3 2/2] vt: vt_ioctl: fix use-after-free in vt_in_use() Eric Biggers
2020-03-27 10:30 ` Jiri Slaby
2020-03-24 11:29 ` [PATCH v3 0/2] vt: fix some vt_ioctl races Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=e2846610-ae0b-8e50-0fc4-c2cad6b23e9a@suse.com \
--to=jslaby@suse.com \
--cc=ebiggers@kernel.org \
--cc=edumazet@google.com \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-serial@vger.kernel.org \
--cc=nico@fluxnic.net \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).