Received-SPF: softfail (google.com: domain of transitioning linux-kernel-owner@vger.kernel.org does not designate 23.128.96.19 as permitted sender) client-ip=23.128.96.19;
Date:   Wed, 1 Jun 2022 21:34:26 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     =?utf-8?B?5LiA5Y+q54uX?= <chennbnbnb@gmail.com>,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        Jiri Slaby <jirislaby@kernel.org>
Cc:     linux-kernel@vger.kernel.org
Subject: CVE-2022-1462: race condition vulnerability in
 drivers/tty/tty_buffers.c
Message-ID: <20220601183426.GD2168@kadam>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.9.4 (2018-02-28)
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?uZI57c6T/a67vE0M48Pd5EtLoD8jxvfS7e1vzoN3ARYLngmmADlJis3pntfb?=
 =?us-ascii?Q?/BCNfQhFHIlsLoO4Nrq25qiT9bolVgMvlV0IiqxwbgGKQIbSBJxjGMyeuO/1?=
 =?us-ascii?Q?5sivsWruFoq8jnQZvs2XCOQ14gMrMWWkH/9i+mlI2gGzHYYigoVARxxSMRbZ?=
 =?us-ascii?Q?wE+UJ5ZNXSfiCAULKWpwsuaOW1VFWakAZFqKndjrMkxZeOk6n/YCtqIi9pj2?=
 =?us-ascii?Q?RptyIh0KB1cxEPMG7Vw65SkMXniIYVTOpeJOLf+lSdhMh5/Q+VQ206fXdpW8?=
 =?us-ascii?Q?IApKBTJihQhvp27o7TcytO4Te8EVmiVgM0LTTjO6YpaEvZAk2paFBnQ0Y5Lt?=
 =?us-ascii?Q?Hc6X0pPo8KA7XUymXdbwEw4cuuBfPqApddu9wdzhh7H+43EJHC9eB8yCASs7?=
 =?us-ascii?Q?6krc4BYOmRyL0fiQnqNZun9w3zZfYjeCwI28YmHUFQpgzgu+xHB37SzOxD8U?=
 =?us-ascii?Q?xbU6UHBCErI989ecrlTFOSvpVIGsd+vc3RewPsyyuFJ2O5kwM5OtyQBMS7+y?=
 =?us-ascii?Q?6dQnraSa20ylEroV8MdFyTCjspoZVjoQqJ+ZPlG3vrmaxe1nqAmxnvGxd+YC?=
 =?us-ascii?Q?Beg7+qkdg7ug6iScanU+0fnafX9OhvZHOBO5le9knJ4xl8+XIUmZQw4ZNL/u?=
 =?us-ascii?Q?MAdm6N5IY0G7z99bpm2nuyXxzETuKmMcmgjQQ2Qkl/+lNBblIrpu+dhX6vja?=
 =?us-ascii?Q?eHlkfNKpC45C1KhNGbdJRXkd9O3SZ+BeR/zP1xmZFVbDQZoVLY20+V2CKhL/?=
 =?us-ascii?Q?4BYkxXRI6ntqYFMV0t1NPe+Jn5vb3mJ8GKmu5wgUz5UtiCXLWALSzi6OzT4Q?=
 =?us-ascii?Q?2ekX04nt73rSrBxl5v6mksq54PZJW8omXiuLrBH1byqz2tOS9m5jdqRkzDnB?=
 =?us-ascii?Q?vwdR+RrHLePsKIUZVObTZO+7fpOZBhNuFr2609hsAFwXQnFdf0fksCQfa6Mw?=
 =?us-ascii?Q?w6VSoLihjyBIQdjCmGkVDRSkz8yTkQroPqVSu5HU3jLClRKpDrm85D+/VZyA?=
 =?us-ascii?Q?2qumMy68C01zUBWGQYWsPUEEtYsaMGzXLgG6XY5y3j6EJNIuoPzJg2wzMXLg?=
 =?us-ascii?Q?QzMN61eOXH3hTeQBhevELBgWIg9B9VImcfiM/aJ33y3lubRloEZpQVS3M7pP?=
 =?us-ascii?Q?YnjdeQyLAz6mHZgA9z6cGSiiIwSJfxKr3bw6oChKLMFM3iuZWcZfjbUZ9uA7?=
 =?us-ascii?Q?qNMrCimVKdZaMORXDgxWTpSoGTKZecuz3LFqz7KSU6BdTxpC8K/5fdqZrXcd?=
 =?us-ascii?Q?o73OoE9Sp82Pavwd3yxyugaSsbH1PhA9znaUANszIBKJ2DfvQMFU6lER07X9?=
 =?us-ascii?Q?LF4no3ANtbE+UB6LgXU7domyI1F3QXJejzbRPZiAgObgb4NE/lFOXcR3TzAU?=
 =?us-ascii?Q?DGYj5cv6Wb2xe7kd4jkddMKvU1RjDPl8DpOWMDYBMub5OXTsSLmvGYC5/lxM?=
 =?us-ascii?Q?WhkZlIJRDSxziBLhkNFQej0MsX6mzfPBF2RcjXJfPexyDUlnEgZmor082rfP?=
 =?us-ascii?Q?KsJi5j1LsMyWIy6pU9dtHJ1s/ucs/8Xq/sqbyfNnMSnk7xYxDo6P+yB49p54?=
 =?us-ascii?Q?NjbzrzpApJwpKa3GyIk54Guml7IP/j+QXOoZ66nyFfjnvuSvMMUW59EjYoTJ?=
 =?us-ascii?Q?sSx6dwO0YTEx29arZZLHWZOxAnGmLuYqDGO9ariQV14sDrdcmWg6s+piAyx4?=
 =?us-ascii?Q?XhvdE0e0wFkGDtpc8IVvD1j6HcVxeJ6I7Ktn/HGG1g8UPfsWDMDXkQmU9zIv?=
 =?us-ascii?Q?wNqfFMTpWAlbSY7Ge3Kh0kpYR4XaKyU=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: c01ff20d-8cd2-4269-8284-08da43fd65d6
X-MS-Exchange-CrossTenant-AuthSource: MWHPR1001MB2365.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Jun 2022 18:34:44.2408
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: MipUVUvEVjNgdwXJohkXuu5u3OnfKp5+V1vjvJY1+IOC0TlFamCg10jGqfpWvijqUoRcN8kO5EP0r3EeeGG32rX2z0ElQQvAiOiMrnFgHkY=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN6PR10MB2718
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.517,18.0.874
 definitions=2022-06-01_07:2022-06-01,2022-06-01 signatures=0
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 mlxscore=0 phishscore=0
 suspectscore=0 mlxlogscore=702 bulkscore=0 spamscore=0 malwarescore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2204290000
 definitions=main-2206010078
X-Proofpoint-GUID: rpsBY5vaLBl77Hr2VqX6iFr3yadIBKQ0
X-Proofpoint-ORIG-GUID: rpsBY5vaLBl77Hr2VqX6iFr3yadIBKQ0
X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIM_SIGNED,
	DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,
	MAILING_LIST_MULTI,RDNS_NONE,SPF_HELO_NONE,T_SCC_BODY_TEXT_LINE
	autolearn=no autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
	lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Hi Greg, Jiri,

I searched lore.kernel.org and it seemed like CVE-2022-1462 might not
have ever been reported to you?  Here is the original email with the
syzkaller reproducer.

https://seclists.org/oss-sec/2022/q2/155

The reporter proposed a fix, but it won't work.  Smatch says that some
of the callers are already holding the port->lock.  For example,
sci_dma_rx_complete() will deadlock.

regards,
dan carpenter