Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Sender: Salvatore Bonaccorso <salvatore.bonaccorso@gmail.com>
Date:   Wed, 22 Jun 2022 16:27:08 +0200
From:   Salvatore Bonaccorso <carnil@debian.org>
To:     Jiri Slaby <jirislaby@kernel.org>
Cc:     Hillf Danton <hdanton@sina.com>,
        Dan Carpenter <dan.carpenter@oracle.com>,
        ChenBigNB <chennbnbnb@gmail.com>,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        linux-mm@kvack.org, linux-kernel@vger.kernel.org
Subject: Re: CVE-2022-1462: race condition vulnerability in
 drivers/tty/tty_buffers.c
Message-ID: <YrMmvAoCAKmr7UhZ@eldamar.lan>
References: <20220602024857.4808-1-hdanton@sina.com>
 <0dc35f2e-746c-bcec-160c-645055a6f8d2@kernel.org>
 <ca7fdc92-b94e-56e8-3d4a-739535cdf8c3@kernel.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <ca7fdc92-b94e-56e8-3d4a-739535cdf8c3@kernel.org>
Precedence: bulk

hi,

On Wed, Jun 15, 2022 at 12:47:20PM +0200, Jiri Slaby wrote:
> On 02. 06. 22, 6:48, Jiri Slaby wrote:
> > On 02. 06. 22, 4:48, Hillf Danton wrote:
> > > On Wed, 1 Jun 2022 21:34:26 +0300 Dan Carpenter wrote:
> > > > Hi Greg, Jiri,
> > > > 
> > > > I searched lore.kernel.org and it seemed like CVE-2022-1462 might not
> > > > have ever been reported to you?? Here is the original email with the
> > > > syzkaller reproducer.
> > > > 
> > > > https://seclists.org/oss-sec/2022/q2/155
> > > > 
> > > > The reporter proposed a fix, but it won't work.? Smatch says that some
> > > > of the callers are already holding the port->lock.? For example,
> > > > sci_dma_rx_complete() will deadlock.
> > > 
> > > Hi Dan
> > > 
> > > To erase the deadlock above, we need to add another helper folding
> > > tty_insert_flip_string() and tty_flip_buffer_push() into one nutshell,
> > > with buf->tail covered by port->lock.
> > > 
> > > The diff attached in effect reverts
> > > 71a174b39f10 ("pty: do tty_flip_buffer_push without port->lock in
> > > pty_write").
> > > 
> > > Only for thoughts now.
> > 
> > I think this the likely the best approach. Except few points inlined below.
> > 
> > Another would be to split tty_flip_buffer_push() into two and call only
> > the first one (doing smp_store_release()) inside the lock. I tried that
> > already, but it looks much worse.
> > 
> > Another would be to add flags to tty_flip_buffer_push(). Like
> > ONLY_ADVANCE and ONLY_QUEUE. Call with the first under the lock, the
> > second outside.
> > 
> > Ideas, comments?
> 
> Apparently not, so Hillf, could you resend your patch after fixing the
> comments below?

Any news here? I'm not sure if I missed the followup submission but
was not able to find it.

Regards,
Salvatore