CVE-2022-1462: race condition vulnerability in drivers/tty/tty_buffers.c

[Hillf Danton <hdanton@sina.com>]

On Wed, 1 Jun 2022 21:34:26 +0300 Dan Carpenter wrote:
> Hi Greg, Jiri,
> 
> I searched lore.kernel.org and it seemed like CVE-2022-1462 might not
> have ever been reported to you?  Here is the original email with the
> syzkaller reproducer.
> 
> https://seclists.org/oss-sec/2022/q2/155
> 
> The reporter proposed a fix, but it won't work.  Smatch says that some
> of the callers are already holding the port->lock.  For example,
> sci_dma_rx_complete() will deadlock.

Hi Dan

To erase the deadlock above, we need to add another helper folding
tty_insert_flip_string() and tty_flip_buffer_push() into one nutshell,
with buf->tail covered by port->lock.

The diff attached in effect reverts
71a174b39f10 ("pty: do tty_flip_buffer_push without port->lock in pty_write").

Only for thoughts now.

Hillf

+++ b/drivers/tty/pty.c
@@ -116,15 +116,8 @@ static int pty_write(struct tty_struct *
 	if (tty->flow.stopped)
 		return 0;
 
-	if (c > 0) {
-		spin_lock_irqsave(&to->port->lock, flags);
-		/* Stuff the data into the input queue of the other end */
-		c = tty_insert_flip_string(to->port, buf, c);
-		spin_unlock_irqrestore(&to->port->lock, flags);
-		/* And shovel */
-		if (c)
-			tty_flip_buffer_push(to->port);
-	}
+	if (c > 0)
+		c = tty_flip_insert_and_push_buffer(to->port, buf, c);
 	return c;
 }
 
+++ b/drivers/tty/tty_buffer.c
@@ -554,6 +554,26 @@ void tty_flip_buffer_push(struct tty_por
 }
 EXPORT_SYMBOL(tty_flip_buffer_push);
 
+int tty_flip_insert_and_push_buffer(struct tty_port *port, const unsigned char *string, int cnt)
+{
+	struct tty_bufhead *buf = &port->buf;
+	unsigned long flags;
+
+	spin_lock_irqsave(&port->lock, flags);
+	cnt = tty_insert_flip_string(port, string, cnt);
+	if (cnt) {
+		/*
+		 * Paired w/ acquire in flush_to_ldisc(); ensures flush_to_ldisc() sees
+		 * buffer data.
+		 */
+		smp_store_release(&buf->tail->commit, buf->tail->used);
+	}
+	spin_unlock_irqrestore(&port->lock, flags);
+	queue_work(system_unbound_wq, &buf->work);
+	return cnt;
+}
+EXPORT_SYMBOL(tty_flip_insert_and_push_buffer);
+
 /**
  * tty_buffer_init		-	prepare a tty buffer structure
  * @port: tty port to initialise