From patchwork Tue Jan 14 14:32:44 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Richard Palethorpe X-Patchwork-Id: 1222834 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (no SPF record) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=suse.com Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 47xtHF2SxQz9sPn for ; Wed, 15 Jan 2020 01:33:29 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728905AbgANOdZ (ORCPT ); Tue, 14 Jan 2020 09:33:25 -0500 Received: from mx2.suse.de ([195.135.220.15]:49890 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725994AbgANOdZ (ORCPT ); Tue, 14 Jan 2020 09:33:25 -0500 X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.220.254]) by mx2.suse.de (Postfix) with ESMTP id 1DC9CBAFA; Tue, 14 Jan 2020 14:33:22 +0000 (UTC) From: Richard Palethorpe To: linux-can@vger.kernel.org Cc: Richard Palethorpe , syzbot+017e491ae13c0068598a@syzkaller.appspotmail.com, Wolfgang Grandegger , Marc Kleine-Budde , "David S. Miller" , Tyler Hall , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, syzkaller@googlegroups.com Subject: [PATCH] can, slip: Protect tty->disc_data access with RCU Date: Tue, 14 Jan 2020 15:32:44 +0100 Message-Id: <20200114143244.20739-1-rpalethorpe@suse.com> X-Mailer: git-send-email 2.24.0 In-Reply-To: <0000000000002b81b70590a83ad7@google.com> References: <0000000000002b81b70590a83ad7@google.com> MIME-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org write_wakeup can happen in parallel with close where tty->disc_data is set to NULL. So we a) need to check if tty->disc_data is NULL and b) ensure it is an atomic operation. Otherwise accessing tty->disc_data could result in a NULL pointer deref or access to some random location. This problem was found by Syzkaller on slcan, but the same issue appears to exist in slip where slcan was copied from. A fix which didn't use RCU was posted by Hillf Danton. Fixes: 661f7fda21b1 ("slip: Fix deadlock in write_wakeup") Fixes: a8e83b17536a ("slcan: Port write_wakeup deadlock fix from slip") Reported-by: syzbot+017e491ae13c0068598a@syzkaller.appspotmail.com Signed-off-by: Richard Palethorpe Cc: Wolfgang Grandegger Cc: Marc Kleine-Budde Cc: "David S. Miller" Cc: Tyler Hall Cc: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: syzkaller@googlegroups.com Reported-by: syzbot+017e491ae13c0068598a@syzkaller.appspotmail.com Signed-off-by: Richard Palethorpe --- Note, that mabye RCU should also applied to receive_buf as that also happens in interrupt context. So if the pointer assignment is split by the compiler then sl may point somewhere unexpected? drivers/net/can/slcan.c | 11 +++++++++-- drivers/net/slip/slip.c | 11 +++++++++-- 2 files changed, 18 insertions(+), 4 deletions(-) diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c index 2e57122f02fb..ee029aae69d4 100644 --- a/drivers/net/can/slcan.c +++ b/drivers/net/can/slcan.c @@ -344,7 +344,14 @@ static void slcan_transmit(struct work_struct *work) */ static void slcan_write_wakeup(struct tty_struct *tty) { - struct slcan *sl = tty->disc_data; + struct slcan *sl; + + rcu_read_lock(); + sl = rcu_dereference(tty->disc_data); + rcu_read_unlock(); + + if (!sl) + return; schedule_work(&sl->tx_work); } @@ -644,7 +651,7 @@ static void slcan_close(struct tty_struct *tty) return; spin_lock_bh(&sl->lock); - tty->disc_data = NULL; + rcu_assign_pointer(tty->disc_data, NULL); sl->tty = NULL; spin_unlock_bh(&sl->lock); diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c index 2a91c192659f..dfed9f0b8646 100644 --- a/drivers/net/slip/slip.c +++ b/drivers/net/slip/slip.c @@ -452,7 +452,14 @@ static void slip_transmit(struct work_struct *work) */ static void slip_write_wakeup(struct tty_struct *tty) { - struct slip *sl = tty->disc_data; + struct slip *sl; + + rcu_read_lock(); + sl = rcu_dereference(tty->disc_data); + rcu_read_unlock(); + + if (!sl) + return; schedule_work(&sl->tx_work); } @@ -882,7 +889,7 @@ static void slip_close(struct tty_struct *tty) return; spin_lock_bh(&sl->lock); - tty->disc_data = NULL; + rcu_assign_pointer(tty->disc_data, NULL); sl->tty = NULL; spin_unlock_bh(&sl->lock);