Received-SPF: pass (google.com: domain of linux-kernel+bounces-146786-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99;
From: "Starke, Daniel" <daniel.starke@siemens.com>
To: Jiri Slaby <jirislaby@kernel.org>, Yewon Choi <woni9911@gmail.com>, Greg
 Kroah-Hartman <gregkh@linuxfoundation.org>, "linux-kernel@vger.kernel.org"
	<linux-kernel@vger.kernel.org>, "linux-serial@vger.kernel.org"
	<linux-serial@vger.kernel.org>
CC: "Dae R. Jeong" <threeearcat@gmail.com>,
	"syzbot+6e3e8f30f269f5028e5d@syzkaller.appspotmail.com"
	<syzbot+6e3e8f30f269f5028e5d@syzkaller.appspotmail.com>
Subject: RE: tty: n_gsm: race condition in gsmld_ioctl
Thread-Topic: tty: n_gsm: race condition in gsmld_ioctl
Thread-Index: AQHaj+0lLWtf51OqqE+4kuIvMRZt1bFq0sPw
Date: Tue, 16 Apr 2024 12:26:30 +0000
Message-ID:
 <DB9PR10MB5881D2170678C169FB42A423E0082@DB9PR10MB5881.EURPRD10.PROD.OUTLOOK.COM>
References: <Zh5Zj35zeobGGzKj@libra05>
 <69b4cd22-3a02-4d5c-a110-152b8ba8200b@kernel.org>
In-Reply-To: <69b4cd22-3a02-4d5c-a110-152b8ba8200b@kernel.org>
Accept-Language: de-DE, en-US
Content-Language: de-DE
msip_labels:
 MSIP_Label_9d258917-277f-42cd-a3cd-14c4e9ee58bc_ActionId=cd9348bd-3e48-4faf-a304-f8d78ae40813;MSIP_Label_9d258917-277f-42cd-a3cd-14c4e9ee58bc_ContentBits=0;MSIP_Label_9d258917-277f-42cd-a3cd-14c4e9ee58bc_Enabled=true;MSIP_Label_9d258917-277f-42cd-a3cd-14c4e9ee58bc_Method=Standard;MSIP_Label_9d258917-277f-42cd-a3cd-14c4e9ee58bc_Name=restricted;MSIP_Label_9d258917-277f-42cd-a3cd-14c4e9ee58bc_SetDate=2024-04-16T11:48:53Z;MSIP_Label_9d258917-277f-42cd-a3cd-14c4e9ee58bc_SiteId=38ae3bcd-9579-4fd4-adda-b42e1495d55a;
authentication-results: dkim=none (message not signed)
 header.d=none;dmarc=none action=none header.from=siemens.com;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: DB9PR10MB5881:EE_|AS8PR10MB6842:EE_
x-ms-office365-filtering-correlation-id: a0f8cefb-d9e3-4ed7-8816-08dc5e10722e
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info:
 WNGlsTXnxCbxylEaQ/B8FjDQYpy6jSr4+akScXI89wqGabcXnWTq05/MB1qGyR52ulTeZTqktpr4/kGuk7L60JnVLfowks6R382HxX08T2eeJlX2zEV5D3JSumk6DCOmoTEUOdzSPNndHU7aUQZhkNBHJZlTSomBbt+GZ6bxeDZHxuvFxC3Bh3+NRbBILS2H6hmyINRW1nR2otUCnR/J4ydcCdFqoZgPm5ZZ9FnZxuWMpIrQOl4LSXHam2D/sy314NKcZOlxBA0hP8WvJ9ijmd++2EsezbPwtgey/YlS/SviEZ75ORVS1bLJaBaDTo8KbaA395CFQOO/LvSZWgXvBmREbaRP6qQGVwRV/L6cuDpBjaviStqWGqRjM/zzlrxhTY+H9N1c0xPh6TjQ3mPLsJVpVXzZGCglQPaHKknyO2xrLQgPvU2UvI22bsC2+vS8fz9AGkG08+tlVqnrdFKgDKGCJ8UV1p0HVGH/Rc83AOjl1zKMs8jPM8NHM8ZsMWYcMJTtixSFDb1AldAcska3VNptos8kITsjVH1triwqsDlZyjHsgc+6Hwel1Qm55o36AGg/4RwG2zVo1Taz1OtPTHrWnbos1g25W25N5CU359SMyeWQIePFU+aqnFGT2OMR9NtheT8Ig0gd8kX98dF/kHEOcFCbAzmdgWz08c96AfX8OV/nfq2DtTTaZukooc3prPxsa7H6CSyDPm7As5lYVwuw5zHbOOMfNZdsCmmkQrU=
x-forefront-antispam-report:
 CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DB9PR10MB5881.EURPRD10.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230031)(1800799015)(376005)(366007)(38070700009);DIR:OUT;SFP:1101;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0:
 =?us-ascii?Q?fIowiVSkFI+KS1jmEkRAE7lnvHllXDsqD2vrp4hrERSGhi4sdrm5W+UwW5Cc?=
 =?us-ascii?Q?J0l7nyOAw/w68K4kesFfkIgJjkaRDBLI4RbXBSt5PJb28cGRo3ADX/QDHrs/?=
 =?us-ascii?Q?os938bb+QZh05rQZznKaqd2p3yUILUjJq67vyTyE9OhuRyG3Zge02Jx4evpD?=
 =?us-ascii?Q?wM8fmrBAhd2SXQQE4taZVSRW6yHkIuslpcS/RLSm0TzpU9HTbYnxvmt3VluG?=
 =?us-ascii?Q?UyrrFwGEHq0wnB2i5/+lO1LB3DBT/V+BEOkIwtK6Cj1JxMD1xrSJ4NjrlHMK?=
 =?us-ascii?Q?8pfAvDLXiofBq3k6e4RWjqVRXIJQls3wWQplVnjzCPgu5nB291YbSIyKtGr/?=
 =?us-ascii?Q?DM2jc3BuRmNoJfZQwPWpwz+vG10plWRykvSCwV93WtfJk+hMdHsldMMtGS1G?=
 =?us-ascii?Q?HwVk5n/XDCkW417uF0cudGgGPw8IBQkEgxbhtf+68X7JmE77uDs53RO/4flU?=
 =?us-ascii?Q?MbNgwK9PO+UtQtivvU4L6WUbl0Y4vlistdfYNSnRkOvIjb664B4+9U5Ew/8h?=
 =?us-ascii?Q?sFGHpNucSbUdScDMOcMnr+H9wA32tXahJh/WhmGSpDLmF7kXmzXeHYV2ypB4?=
 =?us-ascii?Q?8oXqp2UtdrTMrwDI8MkmQT1tM0kIbaEoQ1M1xCTGUX/D0hXBt599hTrSBOBQ?=
 =?us-ascii?Q?Z9XFUkwM7M2VK3aOzxZc5PGG044nZAjtFsn7/P63XNZQE6ne3U50jpt7rrjY?=
 =?us-ascii?Q?9h8ov5w9c9qtEGDBmZvlxg+GYEmLa750sAwoLjMqvWqxEBWYltMHHypTbc1C?=
 =?us-ascii?Q?vqNQrJlhLOd5VIdttHsqHTgfBvsWw/Srf8GfvDEaBH+IqQwkM7dfOftVrtiX?=
 =?us-ascii?Q?Gi00TrsaaI6k+PFCIqQxcKxzIaU00J2RIMs7fZPP/aDYNWz8AQoDYkUUYPzs?=
 =?us-ascii?Q?daDATXBCT8M1XiC6yLQNcly03dl/PfNM5ooAxHHG79m4Z1aq1xoTBdP3sVxX?=
 =?us-ascii?Q?nKmW9TMSQ5KHLJWKbzEezsfIKtQAKy+whpyPr/Z7U5i4qDDtE5fSv59Ou2rr?=
 =?us-ascii?Q?hhE208//fLDD5R6GbUJlHTEl8WAR0Plt7oAD5OX+huuRaEq0OcqDj2PB5qyF?=
 =?us-ascii?Q?+TEMgYbMuY9qp8VYKuWaO/1DkXHz7kGqkCzbdXyB1NKRn+tlPejM6A/sWHCe?=
 =?us-ascii?Q?cyRQep+ZouotOdNAcQWTQV0eAgEPXMcwQ5pWAx39DuYgyaZfmYnRny0lUVUS?=
 =?us-ascii?Q?wFaI+rWNLD1AevR2TF/iFaqtSbAebpdzATexWJZbzPycFLNB+ua6s7mP08ys?=
 =?us-ascii?Q?lGz9Fxl3Bzpn/I9Sh9dPocWXaOCECK7TpwzeBEVt5afUjUKDoIFL3l5InmA9?=
 =?us-ascii?Q?+QuS50eJtmn+kRS5Ewgai1Uum7s7U9Jk3ZHALURtzz5cGBMAW7rebuoHbpKF?=
 =?us-ascii?Q?UoPwq2Vlr9eKBnnMcjzG0+Hxxvplls7MnurSDoweriL/MH4Y7W6IvijlFrhK?=
 =?us-ascii?Q?sIbcaAdMi/CApiuqZe45WjGDmV7LUI9hqosoFfnt0si504oFL4uQXsMWmJwX?=
 =?us-ascii?Q?3Qm6TpTXGvTBPvhPfT/M/wAu6mpCeojn/l8WKJXswUMdrLrsmlJVQa+IT7Uo?=
 =?us-ascii?Q?3JdXmT92aQdS8umVKXsjYyF/xlv7rXpAzugzR24X?=
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk
X-Mailing-List: linux-kernel@vger.kernel.org
List-Id: <linux-kernel.vger.kernel.org>
List-Subscribe: <mailto:linux-kernel+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:linux-kernel+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
X-OriginatorOrg: siemens.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: DB9PR10MB5881.EURPRD10.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-Network-Message-Id: a0f8cefb-d9e3-4ed7-8816-08dc5e10722e
X-MS-Exchange-CrossTenant-originalarrivaltime: 16 Apr 2024 12:26:30.7863
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 38ae3bcd-9579-4fd4-adda-b42e1495d55a
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: yeHrdNRRQf1KiYXEziGPzGZBW0jHhKh9b1zthbtLEMTr4CE4qVv5C4kAP/CK8vETpObkQKbvYGUlf+06iYhM0l9mJmQFo5d4pNAxgpcMmHg=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8PR10MB6842

> We think either (1) gsm_dlci_alloc() should hold a lock(mutex) and do=20
> internal check about whether gsm->dlci[addr] is NUll or not, OR
> (2) all callers of gsm_dlci_alloc() should hold gsm->mutex and check=20
> whether gsm->dlci[addr] is NUll or not (like gsmtty_install()).
>=20
> Could you check this? If it makes sense, we will write a patch=20
> following one of the suggestions.

We are currently dealing with multiple race conditions in the n_gsm. Not
only for the syzkaller reports but in recent exploits for example, too.
I believe we need an overall concept/solution for these.

Currently, the following actors can race:
- ioctl (e.g. resetting the mux or one of its DLCIs)
- ldisc callbacks (e.g. receiving SABM or DISC in gsm_queue())
- tty callbacks (e.g. gsmtty_hangup())
- internal write task (gsmld_write_task())
- internal timers (e.g. gsm_control_keep_alive())
- driver removal

Each with another and ioctl's from multiple threads.

Guarding these is not trivial for the following reasons:
- execution context may not allow sleep (timers, write task, tty callbacks?=
)
- creating an atomic section may conflict inner sleeps (e.g. ioctl)
- dead-locking needs to be considered
- locking may introduce high performance bottlenecks

Still, not guarding one of the racing actors does not appears to be
possible as I see it.

Unfortunately, for the same reason the sleep while atomic issue when using
a console on a virtual tty has not been fixed yet, I have no solution at
hand. We are dealing with a quite complex situation here.

Nevertheless, creating many small patches here and there should not be our
solution for obvious reasons. This does not give a complete solution and
makes it harder to find the remaining corner cases.

I can assist to find a solution here, but I have not enough time to do this
alone at the moment.

Best regards,
Daniel Starke