tty: fix break race
Subsystems (2)
A message that is not in the archive (sent off-list or not yet received): [email protected]
PATCH 1/1 tty: fix break race
A timed break (TCSBRK and TCSBRKP) can race against hangup and end up calling into a tty driver after the underlying device has been removed, for example when a USB serial device is disconnected while a break is in progress. This can result in a use-after-free or NULL-pointer dereference in the driver when the second break_ctl() call is made after the sleep, as reported for the keyspan USB serial driver.
Make send_break() wait only for the break duration and then check the hung-up state of the tty before invoking the driver a second time. Since the tty is marked hung up (f_op == &hung_up_tty_fops) before the device is torn down, the second break_ctl() is no longer issued after a hangup and the driver is not called for a device that is gone.
Suggested-by Johan Hovold <[email protected]>
Reported-by [email protected]
Assisted-by opencode:deepseek-v4-flash
Signed-off-by Adriano Cordova <[email protected]>
#syz test
--- drivers/tty/tty_io.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/tty/tty_io.c +8 -4
@@ -2429,6 +2429,7 @@ static int tiocgetd(struct tty_struct *tty, int __user *p)/** * send_break - performed time break +* @file: file object * @tty: device to break on * @duration: timeout in mS *
@@ -2438,7 +2439,7 @@ static int tiocgetd(struct tty_struct *tty, int __user *p)* Locking: * @tty->atomic_write_lock serializes */ -static int send_break (struct tty_struct *tty,unsigned int duration) +static int send_break (struct file *file,struct tty_struct *tty,unsigned int duration) {int retval;
@@ -2455,7 +2456,10 @@ static int send_break(struct tty_struct *tty, unsigned int duration) retval = tty->ops->break_ctl (tty,-1 );if (!retval) {msleep_interruptible (duration); - retval = tty->ops->break_ctl (tty,0 ); +if (tty_hung_up_p (file)) + retval = -EIO ; +else + retval = tty->ops->break_ctl (tty,0 ); }else if (retval == -EOPNOTSUPP ) {/* some drivers can tell only dynamically */ retval =0 ;
@@ -2727,10 +2731,10 @@ long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)* This is used by the tcdrain() termios function. */ if (!arg) -return send_break (tty,250 ); +return send_break (file, tty,250 );return 0 ;case TCSBRKP :/* support for POSIX tcsendbreak() */ -return send_break (tty, arg ? arg*100 :250 ); +return send_break (file, tty, arg ? arg *100 :250 );case TIOCMGET :return tty_tiocmget (tty, p);
Signature · 1 line
2.51.0
syzbot
syzbotRe: [syzbot] [usb?] general protection fault in keyspan_break_ctl
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
general protection fault in keyspan_break_ctl Oops: general protection fault, probably for non-canonical address 0xdffffc0000000013: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000098-0x000000000000009f] CPU: 3 UID: 0 PID: 6463 Comm: syz.3.20 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:keyspan_break_ctl+0x8e/0xe0 drivers/usb/serial/keyspan.c:608 Code: ff ff ff e8 24 67 42 fa 83 fb ff 48 b8 00 00 00 00 00 fc ff df 49 8d bc 24 9c 00 00 00 0f 94 c3 48 89 fa 0f b6 db 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 1d 41 RSP: 0018:ffffc9000334fca8 EFLAGS: 00010203 RAX: dffffc0000000000 RBX: 0000000000000001 RCX: ffffffff87c9835c RDX: 0000000000000013 RSI: 00000000ffffffff RDI: 000000000000009c RBP: ffff888059412000 R08: 0000000000000005 R09: 00000000ffffffff R10: 00000000ffffffff R11: 0000000000000000 R12: 0000000000000000 R13: ffff888038a76e00 R14: ffff88802aef6020 R15: ffff88802aef60c8 FS: 00007f62980d46c0(0000) GS:ffff8880d5e61000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f41412c8d58 CR3: 0000000025cea000 CR4: 0000000000352ef0 Call Trace: <TASK> serial_break+0xcb/0x160 drivers/usb/serial/usb-serial.c:538 send_break drivers/tty/tty_io.c:2456 [inline] send_break+0x194/0x3b0 drivers/tty/tty_io.c:2442 tty_ioctl+0xa2f/0x1640 drivers/tty/tty_io.c:2737 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f629719e0d9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f62980d4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f6297425fa0 RCX: 00007f629719e0d9 RDX: 0000000000000000 RSI: 0000000000005425 RDI: 0000000000000004 RBP: 00007f6297235024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f6297426038 R14: 00007f6297425fa0 R15: 00007ffcf04a40e8 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:keyspan_break_ctl+0x8e/0xe0 drivers/usb/serial/keyspan.c:608 Code: ff ff ff e8 24 67 42 fa 83 fb ff 48 b8 00 00 00 00 00 fc ff df 49 8d bc 24 9c 00 00 00 0f 94 c3 48 89 fa 0f b6 db 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 1d 41 RSP: 0018:ffffc9000334fca8 EFLAGS: 00010203 RAX: dffffc0000000000 RBX: 0000000000000001 RCX: ffffffff87c9835c RDX: 0000000000000013 RSI: 00000000ffffffff RDI: 000000000000009c RBP: ffff888059412000 R08: 0000000000000005 R09: 00000000ffffffff R10: 00000000ffffffff R11: 0000000000000000 R12: 0000000000000000 R13: ffff888038a76e00 R14: ffff88802aef6020 R15: ffff88802aef60c8 FS: 00007f62980d46c0(0000) GS:ffff8880d5d61000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055aeb7ddb480 CR3: 0000000025cea000 CR4: 0000000000352ef0 ---------------- Code disassembly (best guess), 2 bytes skipped: 0: ff ljmp (bad) 1: e8 24 67 42 fa call 0xfa42672a 6: 83 fb ff cmp $0xffffffff,%ebx 9: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 10: fc ff df 13: 49 8d bc 24 9c 00 00 lea 0x9c(%r12),%rdi 1a: 00 1b: 0f 94 c3 sete %bl 1e: 48 89 fa mov %rdi,%rdx 21: 0f b6 db movzbl %bl,%ebx 24: 48 c1 ea 03 shr $0x3,%rdx * 28: 0f b6 14 02 movzbl (%rdx,%rax,1),%edx <-- trapping instruction 2c: 48 89 f8 mov %rdi,%rax 2f: 83 e0 07 and $0x7,%eax 32: 83 c0 03 add $0x3,%eax 35: 38 d0 cmp %dl,%al 37: 7c 04 jl 0x3d 39: 84 d2 test %dl,%dl 3b: 75 1d jne 0x5a 3d: 41 rex.B
Tested on:
commit: 940de590 Merge tag 'hardening-v7.3-rc2' of git://git.k.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=10641f79580000 kernel config: https://syzkaller.appspot.com/x/.config?x=8c5c3949d762a91f dashboard link: https://syzkaller.appspot.com/bug?extid=473d7477c523b41d4046 compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 patch: https://syzkaller.appspot.com/x/patch.diff?x=10f81f79580000