Soft lockup occurs when vt device used n_null ldisc, n_null_receivebuf()
is not implemented in null_ldisc. So tty_ldisc_receive_buf always return
0 in paste_selection(), this cause deadloop and cause soft lockup.
This can be reproduced as follows:
int ldisc = 0x1b; // 0x1b is n_null
struct{
char subcode;
struct tiocl_selection sel;
} data;
date.subcode = TIOCL_SETSEL;
data.sel.xs = 0;
data.sel.xe = 1;
data.sel.ys = 0;
data.sel.ye = 1;
data.sel.sel_mode = TIOCL_SELCHAR;
char bytes[2] = {TIOCL_PASTESEL, 0};
open("ttyxx", O_RDWR) // open a vt device
ioctl(fd, TIOCSETD, &ldisc) // set ldisc to n_null
ioctl(fd, TIOCLINUX, &data.subcode);
ioctl(fd, TIOCLINUX, bytes); // cause deadloop
Fix soft lockup by check receive_buf() and receive_buf2() is NULL.
Signed-off-by: Yi Yang <[email protected]>
---
v2:Change Check Condition.
drivers/tty/vt/selection.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/tty/vt/selection.c b/drivers/tty/vt/selection.c
index 564341f1a74f..715e111376a7 100644
--- a/drivers/tty/vt/selection.c
+++ b/drivers/tty/vt/selection.c
@@ -397,6 +397,12 @@ int paste_selection(struct tty_struct *tty)
ld = tty_ldisc_ref_wait(tty);
if (!ld)
return -EIO; /* ldisc was hung up */
+
+ /*tty_ldisc_receive_buf() won't do anything and cause deadloop later*/
+ if (!ld->ops->receive_buf && !ld->ops->receive_buf2) {
+ tty_ldisc_deref(ld);
+ return -EIO;
+ }
tty_buffer_lock_exclusive(&vc->port);
add_wait_queue(&vc->paste_wait, &wait);
--
2.25.1
On Wed, Mar 13, 2024 at 09:45:29AM +0000, Yi Yang wrote:
> Soft lockup occurs when vt device used n_null ldisc, n_null_receivebuf()
> is not implemented in null_ldisc. So tty_ldisc_receive_buf always return
> 0 in paste_selection(), this cause deadloop and cause soft lockup.
Why is a vt using n_null?
What is causing that?
>
> This can be reproduced as follows:
> int ldisc = 0x1b; // 0x1b is n_null
> struct{
> char subcode;
> struct tiocl_selection sel;
> } data;
> date.subcode = TIOCL_SETSEL;
> data.sel.xs = 0;
> data.sel.xe = 1;
> data.sel.ys = 0;
> data.sel.ye = 1;
> data.sel.sel_mode = TIOCL_SELCHAR;
> char bytes[2] = {TIOCL_PASTESEL, 0};
> open("ttyxx", O_RDWR) // open a vt device
> ioctl(fd, TIOCSETD, &ldisc) // set ldisc to n_null
> ioctl(fd, TIOCLINUX, &data.subcode);
> ioctl(fd, TIOCLINUX, bytes); // cause deadloop
>
> Fix soft lockup by check receive_buf() and receive_buf2() is NULL.
As you had permissions to do this, why prevent it?
>
> Signed-off-by: Yi Yang <[email protected]>
> ---
>
> v2:Change Check Condition.
>
> drivers/tty/vt/selection.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/drivers/tty/vt/selection.c b/drivers/tty/vt/selection.c
> index 564341f1a74f..715e111376a7 100644
> --- a/drivers/tty/vt/selection.c
> +++ b/drivers/tty/vt/selection.c
> @@ -397,6 +397,12 @@ int paste_selection(struct tty_struct *tty)
> ld = tty_ldisc_ref_wait(tty);
> if (!ld)
> return -EIO; /* ldisc was hung up */
> +
> + /*tty_ldisc_receive_buf() won't do anything and cause deadloop later*/
Comments need to be properly formated.
And I do not understand this comment sorry.
> + if (!ld->ops->receive_buf && !ld->ops->receive_buf2) {
Why check reciev_buf pointers here? What is that causing?
This needs to be documented a lot better please.
thanks,
greg k-h