CVE-2022-1462: race condition vulnerability in drivers/tty/tty_buffers.c

Hi Greg, Jiri,

I searched lore.kernel.org and it seemed like CVE-2022-1462 might not have ever been reported to you? Here is the original email with the syzkaller reproducer.

https://seclists.org/oss-sec/2022/q2/155

The reporter proposed a fix, but it won't work. Smatch says that some of the callers are already holding the port->lock. For example, sci_dma_rx_complete() will deadlock.

Quoted 11 lines · On Wed, 1 Jun 2022 21:34:26 +0300 Dan Carpenter wrote:

Hi Greg, Jiri,

I searched lore.kernel.org and it seemed like CVE-2022-1462 might not have ever been reported to you? Here is the original email with the syzkaller reproducer.

https://seclists.org/oss-sec/2022/q2/155

The reporter proposed a fix, but it won't work. Smatch says that some of the callers are already holding the port->lock. For example, sci_dma_rx_complete() will deadlock.

Hi Dan

To erase the deadlock above, we need to add another helper folding tty_insert_flip_string() and tty_flip_buffer_push() into one nutshell, with buf->tail covered by port->lock.

The diff attached in effect reverts
71a174b39f10 ("pty: do tty_flip_buffer_push without port->lock in pty_write").

Only for thoughts now.

Hillf

+++ b/drivers/tty/pty.c

(quoted diff) +3 -9

@@ -116,15 +116,8 @@ static int pty_write(struct tty_struct *
  	if (tty->flow.stopped)
  		return 0;
 
-	if (c > 0) {
-		spin_lock_irqsave(&to->port->lock, flags);
-		/* Stuff the data into the input queue of the other end */
-		c = tty_insert_flip_string(to->port, buf, c);
-		spin_unlock_irqrestore(&to->port->lock, flags);
-		/* And shovel */
-		if (c)
-			tty_flip_buffer_push(to->port);
-	}
+	if (c > 0)
+		c = tty_flip_insert_and_push_buffer(to->port, buf, c);
  	return c;
  }
 
+++ b/drivers/tty/tty_buffer.c

(quoted diff) +5 -0

+{
+	struct tty_bufhead *buf = &port->buf;
+	unsigned long flags;
+
+	spin_lock_irqsave(&port->lock, flags);

Quoted 15 lines · Hillf Danton

Quoted 11 lines · On Wed, 1 Jun 2022 21:34:26 +0300 Dan Carpenter wrote:

Hi Greg, Jiri,

I searched lore.kernel.org and it seemed like CVE-2022-1462 might not have ever been reported to you?  Here is the original email with the syzkaller reproducer.

https://seclists.org/oss-sec/2022/q2/155

The reporter proposed a fix, but it won't work.  Smatch says that some of the callers are already holding the port->lock.  For example, sci_dma_rx_complete() will deadlock.

Hi Dan

Quoted 8 lines

To erase the deadlock above, we need to add another helper folding tty_insert_flip_string() and tty_flip_buffer_push() into one nutshell, with buf->tail covered by port->lock.

The diff attached in effect reverts
71a174b39f10 ("pty: do tty_flip_buffer_push without port->lock in pty_write").

Only for thoughts now.

I think this the likely the best approach. Except few points inlined below.

Another would be to split tty_flip_buffer_push() into two and call only the first one (doing smp_store_release()) inside the lock. I tried that already, but it looks much worse.

Another would be to add flags to tty_flip_buffer_push(). Like ONLY_ADVANCE and ONLY_QUEUE. Call with the first under the lock, the second outside.

Ideas, comments?

Quoted 21 lines

Hillf

+++ b/drivers/tty/pty.c

(quoted diff) +3 -9

@@ -116,15 +116,8 @@ static int pty_write(struct tty_struct *
       if (tty->flow.stopped)
           return 0;
-    if (c > 0) {
-        spin_lock_irqsave(&to->port->lock, flags);
-        /* Stuff the data into the input queue of the other end */
-        c = tty_insert_flip_string(to->port, buf, c);
-        spin_unlock_irqrestore(&to->port->lock, flags);
-        /* And shovel */
-        if (c)
-            tty_flip_buffer_push(to->port);
-    }
+    if (c > 0)
+        c = tty_flip_insert_and_push_buffer(to->port, buf, c);
       return c;
   }
+++ b/drivers/tty/tty_buffer.c

Review void tty_flip_buffer_push(struct tty_por · line 557

Quoted 4 lines

(quoted diff) +1 -0

@@ -554,6 +554,26 @@ void tty_flip_buffer_push(struct tty_por
   }
   EXPORT_SYMBOL(tty_flip_buffer_push);
+int tty_flip_insert_and_push_buffer(struct tty_port *port, const 
 unsigned char *string, int cnt)

It should be _insert_string_, IMO.

Quoted 9 lines

(quoted diff) +9 -0

+{
+    struct tty_bufhead *buf = &port->buf;
+    unsigned long flags;
+
+    spin_lock_irqsave(&port->lock, flags);
+    cnt = tty_insert_flip_string(port, string, cnt);
+    if (cnt) {
+        /*
+         * Paired w/ acquire in flush_to_ldisc(); ensures 

Quoted 7 lines

flush_to_ldisc() sees
+         * buffer data.
+         */
+        smp_store_release(&buf->tail->commit, buf->tail->used); +    }
+    spin_unlock_irqrestore(&port->lock, flags);
+    queue_work(system_unbound_wq, &buf->work);

\n here please.

Review

Quoted 3 lines

+    return cnt;

(quoted diff) +2 -0

+}
+EXPORT_SYMBOL(tty_flip_insert_and_push_buffer);

No need to export this, right?

thanks,

Quoted 32 lines · Jiri Slaby

Quoted 19 lines · Hillf Danton

Quoted 11 lines · On Wed, 1 Jun 2022 21:34:26 +0300 Dan Carpenter wrote:

Hi Greg, Jiri,

I searched lore.kernel.org and it seemed like CVE-2022-1462 might not have ever been reported to you?  Here is the original email with the syzkaller reproducer.

https://seclists.org/oss-sec/2022/q2/155

The reporter proposed a fix, but it won't work.  Smatch says that some of the callers are already holding the port->lock.  For example, sci_dma_rx_complete() will deadlock.

Hi Dan

To erase the deadlock above, we need to add another helper folding tty_insert_flip_string() and tty_flip_buffer_push() into one nutshell, with buf->tail covered by port->lock.

Quoted 5 lines

The diff attached in effect reverts
71a174b39f10 ("pty: do tty_flip_buffer_push without port->lock in pty_write").

Only for thoughts now.

I think this the likely the best approach. Except few points inlined below.

Another would be to split tty_flip_buffer_push() into two and call only the first one (doing smp_store_release()) inside the lock. I tried that already, but it looks much worse.

Quoted 5 lines

Another would be to add flags to tty_flip_buffer_push(). Like ONLY_ADVANCE and ONLY_QUEUE. Call with the first under the lock, the second outside.

Ideas, comments?

Apparently not, so Hillf, could you resend your patch after fixing the comments below?