| Message ID | 20230814040131.79439-1-yiyang13@huawei.com |
|---|---|
| State | New |
| Headers | show |
| Series | tty: vt: selection: fix soft lockup in paste_selection() | expand |
On 14. 08. 23, 6:01, Yi Yang wrote: > Soft lockup occurs when vt device used n_null ldisc, n_null_receivebuf() > is not implemented in null_ldisc. So tty_ldisc_receive_buf always return > 0 in paste_selection(), this cause deadloop and cause soft lockup. > > This can be reproduced as follows: > int ldisc = 0x1b; // 0x1b is n_null > struct{ > char subcode; > struct tiocl_selection sel; > } data; > date.subcode = TIOCL_SETSEL; > data.sel.xs = 0; > data.sel.xe = 1; > data.sel.ys = 0; > data.sel.ye = 1; > data.sel.sel_mode = TIOCL_SELCHAR; > char bytes[2] = {TIOCL_PASTESEL, 0}; > open("ttyxx", O_RDWR) // open a vt device > ioctl(fd, TIOCSETD, &ldisc) // set ldisc to n_null > ioctl(fd, TIOCLINUX, &data.subcode); > ioctl(fd, TIOCLINUX, bytes); // cause deadloop > > Fix soft lockup by check if ldisc in paste_selection() is n_null. Ugh, no. What if another ldisc returns with 0 too? So instead, what about checking for progress instead of checking a particular ldisc? > Link: https://lore.kernel.org/all/000000000000fe769905d315a1b7@google.com/ > Fixes: 8a8dabf2dd68 ("tty: handle the case where we cannot restore a line discipline") > Signed-off-by: Yi Yang <yiyang13@huawei.com> > --- > drivers/tty/vt/selection.c | 6 ++++++ > 1 file changed, 6 insertions(+) > > diff --git a/drivers/tty/vt/selection.c b/drivers/tty/vt/selection.c > index 6ef22f01cc51..9ba7f66fcf05 100644 > --- a/drivers/tty/vt/selection.c > +++ b/drivers/tty/vt/selection.c > @@ -388,6 +388,12 @@ int paste_selection(struct tty_struct *tty) > ld = tty_ldisc_ref_wait(tty); > if (!ld) > return -EIO; /* ldisc was hung up */ > + > + /* tty_ldisc_receive_buf() will not do anything when ldisc is n_null*/ > + if (ld->ops->num == N_NULL) { > + tty_ldisc_deref(ld); > + return -EIO; > + } > tty_buffer_lock_exclusive(&vc->port); > > add_wait_queue(&vc->paste_wait, &wait);
diff --git a/drivers/tty/vt/selection.c b/drivers/tty/vt/selection.c index 6ef22f01cc51..9ba7f66fcf05 100644 --- a/drivers/tty/vt/selection.c +++ b/drivers/tty/vt/selection.c @@ -388,6 +388,12 @@ int paste_selection(struct tty_struct *tty) ld = tty_ldisc_ref_wait(tty); if (!ld) return -EIO; /* ldisc was hung up */ + + /* tty_ldisc_receive_buf() will not do anything when ldisc is n_null*/ + if (ld->ops->num == N_NULL) { + tty_ldisc_deref(ld); + return -EIO; + } tty_buffer_lock_exclusive(&vc->port); add_wait_queue(&vc->paste_wait, &wait);
Soft lockup occurs when vt device used n_null ldisc, n_null_receivebuf() is not implemented in null_ldisc. So tty_ldisc_receive_buf always return 0 in paste_selection(), this cause deadloop and cause soft lockup. This can be reproduced as follows: int ldisc = 0x1b; // 0x1b is n_null struct{ char subcode; struct tiocl_selection sel; } data; date.subcode = TIOCL_SETSEL; data.sel.xs = 0; data.sel.xe = 1; data.sel.ys = 0; data.sel.ye = 1; data.sel.sel_mode = TIOCL_SELCHAR; char bytes[2] = {TIOCL_PASTESEL, 0}; open("ttyxx", O_RDWR) // open a vt device ioctl(fd, TIOCSETD, &ldisc) // set ldisc to n_null ioctl(fd, TIOCLINUX, &data.subcode); ioctl(fd, TIOCLINUX, bytes); // cause deadloop Fix soft lockup by check if ldisc in paste_selection() is n_null. Link: https://lore.kernel.org/all/000000000000fe769905d315a1b7@google.com/ Fixes: 8a8dabf2dd68 ("tty: handle the case where we cannot restore a line discipline") Signed-off-by: Yi Yang <yiyang13@huawei.com> --- drivers/tty/vt/selection.c | 6 ++++++ 1 file changed, 6 insertions(+)