Re: [PATCHv2 2/4] tty: Hold tty_ldisc_lock() during tty_reopen()
On 09/03/2018, 06:52 PM, Dmitry Safonov wrote: > tty_ldisc_reinit() doesn't race with neither tty_ldisc_hangup() > nor set_ldisc() nor tty_ldisc_release() as they use tty lock. > But it races with anyone who expects line discipline to be the same > after hoding read semaphore in tty_ldisc_ref(). > > We've seen the following crash on v4.9.108 stable: > > BUG: unable to handle kernel paging request at 2260 > IP: [..] n_tty_receive_buf_common+0x5f/0x86d > Workqueue: events_unbound flush_to_ldisc > Call Trace: > [..] n_tty_receive_buf2 > [..] tty_ldisc_receive_buf > [..] flush_to_ldisc > [..] process_one_work > [..] worker_thread > [..] kthread > [..] ret_from_fork > > tty_ldisc_reinit() should be called with ldisc_sem hold for writing, > which will protect any reader against line discipline changes. > > Cc: Greg Kroah-Hartman > Cc: Jiri Slaby Reviewed-by: Jiri Slaby > Cc: sta...@vger.kernel.org # depends on commit b027e2298bd5 ("tty: fix > data race between tty_init_dev and flush of buf") > Reported-by: syzbot+3aa9784721dfb90e9...@syzkaller.appspotmail.com > Tested-by: Tetsuo Handa > Signed-off-by: Dmitry Safonov thanks, -- js suse labs
Re: [PATCHv2 2/4] tty: Hold tty_ldisc_lock() during tty_reopen()
On 09/03/2018, 06:52 PM, Dmitry Safonov wrote: > tty_ldisc_reinit() doesn't race with neither tty_ldisc_hangup() > nor set_ldisc() nor tty_ldisc_release() as they use tty lock. > But it races with anyone who expects line discipline to be the same > after hoding read semaphore in tty_ldisc_ref(). > > We've seen the following crash on v4.9.108 stable: > > BUG: unable to handle kernel paging request at 2260 > IP: [..] n_tty_receive_buf_common+0x5f/0x86d > Workqueue: events_unbound flush_to_ldisc > Call Trace: > [..] n_tty_receive_buf2 > [..] tty_ldisc_receive_buf > [..] flush_to_ldisc > [..] process_one_work > [..] worker_thread > [..] kthread > [..] ret_from_fork > > tty_ldisc_reinit() should be called with ldisc_sem hold for writing, > which will protect any reader against line discipline changes. > > Cc: Greg Kroah-Hartman > Cc: Jiri Slaby Reviewed-by: Jiri Slaby > Cc: sta...@vger.kernel.org # depends on commit b027e2298bd5 ("tty: fix > data race between tty_init_dev and flush of buf") > Reported-by: syzbot+3aa9784721dfb90e9...@syzkaller.appspotmail.com > Tested-by: Tetsuo Handa > Signed-off-by: Dmitry Safonov thanks, -- js suse labs
Re: [PATCHv2 2/4] tty: Hold tty_ldisc_lock() during tty_reopen()
On (09/04/18 08:30), Jiri Slaby wrote: > > >> Cc: sta...@vger.kernel.org # depends on commit b027e2298bd5 ("tty: fix > >> data race between tty_init_dev and flush of buf") > > > > I believe there's a "Fixes" tag for that > > > > Fixes: b027e2298bd5 ("tty: fix data race between tty_init_dev and flush of > > buf") > > Cc: sta...@vger.kernel.org > > Nope, it would be translated as: > Backport-first: b027e2298bd5 > :) :) Ah, OK. So this "Backport-first:" is for pre-4.9 longterm kernels. As far as I can see linux-4.9.y picked up b027e2298bd5: commit 55eaecffe3d663d02084023b9fc06d5f39b97389 Author: Gaurav Kohli Date: Tue Jan 23 13:16:34 2018 +0530 tty: fix data race between tty_init_dev and flush of buf commit b027e2298bd588d6fa36ed2eda97447fb3eac078 upstream. -ss
Re: [PATCHv2 2/4] tty: Hold tty_ldisc_lock() during tty_reopen()
On (09/04/18 08:30), Jiri Slaby wrote: > > >> Cc: sta...@vger.kernel.org # depends on commit b027e2298bd5 ("tty: fix > >> data race between tty_init_dev and flush of buf") > > > > I believe there's a "Fixes" tag for that > > > > Fixes: b027e2298bd5 ("tty: fix data race between tty_init_dev and flush of > > buf") > > Cc: sta...@vger.kernel.org > > Nope, it would be translated as: > Backport-first: b027e2298bd5 > :) :) Ah, OK. So this "Backport-first:" is for pre-4.9 longterm kernels. As far as I can see linux-4.9.y picked up b027e2298bd5: commit 55eaecffe3d663d02084023b9fc06d5f39b97389 Author: Gaurav Kohli Date: Tue Jan 23 13:16:34 2018 +0530 tty: fix data race between tty_init_dev and flush of buf commit b027e2298bd588d6fa36ed2eda97447fb3eac078 upstream. -ss
Re: [PATCHv2 2/4] tty: Hold tty_ldisc_lock() during tty_reopen()
On 09/04/2018, 03:51 AM, Sergey Senozhatsky wrote: > On (09/03/18 17:52), Dmitry Safonov wrote: >> >> We've seen the following crash on v4.9.108 stable: >> >> BUG: unable to handle kernel paging request at 2260 >> IP: [..] n_tty_receive_buf_common+0x5f/0x86d >> Workqueue: events_unbound flush_to_ldisc >> Call Trace: >> [..] n_tty_receive_buf2 >> [..] tty_ldisc_receive_buf >> [..] flush_to_ldisc >> [..] process_one_work >> [..] worker_thread >> [..] kthread >> [..] ret_from_fork >> >> tty_ldisc_reinit() should be called with ldisc_sem hold for writing, >> which will protect any reader against line discipline changes. >> >> Cc: Greg Kroah-Hartman >> Cc: Jiri Slaby >> Cc: sta...@vger.kernel.org # depends on commit b027e2298bd5 ("tty: fix >> data race between tty_init_dev and flush of buf") > > I believe there's a "Fixes" tag for that > > Fixes: b027e2298bd5 ("tty: fix data race between tty_init_dev and flush of > buf") > Cc: sta...@vger.kernel.org Nope, it would be translated as: Backport-first: b027e2298bd5 :) thanks, -- js suse labs
Re: [PATCHv2 2/4] tty: Hold tty_ldisc_lock() during tty_reopen()
On 09/04/2018, 03:51 AM, Sergey Senozhatsky wrote: > On (09/03/18 17:52), Dmitry Safonov wrote: >> >> We've seen the following crash on v4.9.108 stable: >> >> BUG: unable to handle kernel paging request at 2260 >> IP: [..] n_tty_receive_buf_common+0x5f/0x86d >> Workqueue: events_unbound flush_to_ldisc >> Call Trace: >> [..] n_tty_receive_buf2 >> [..] tty_ldisc_receive_buf >> [..] flush_to_ldisc >> [..] process_one_work >> [..] worker_thread >> [..] kthread >> [..] ret_from_fork >> >> tty_ldisc_reinit() should be called with ldisc_sem hold for writing, >> which will protect any reader against line discipline changes. >> >> Cc: Greg Kroah-Hartman >> Cc: Jiri Slaby >> Cc: sta...@vger.kernel.org # depends on commit b027e2298bd5 ("tty: fix >> data race between tty_init_dev and flush of buf") > > I believe there's a "Fixes" tag for that > > Fixes: b027e2298bd5 ("tty: fix data race between tty_init_dev and flush of > buf") > Cc: sta...@vger.kernel.org Nope, it would be translated as: Backport-first: b027e2298bd5 :) thanks, -- js suse labs
Re: [PATCHv2 2/4] tty: Hold tty_ldisc_lock() during tty_reopen()
On (09/03/18 17:52), Dmitry Safonov wrote: > > We've seen the following crash on v4.9.108 stable: > > BUG: unable to handle kernel paging request at 2260 > IP: [..] n_tty_receive_buf_common+0x5f/0x86d > Workqueue: events_unbound flush_to_ldisc > Call Trace: > [..] n_tty_receive_buf2 > [..] tty_ldisc_receive_buf > [..] flush_to_ldisc > [..] process_one_work > [..] worker_thread > [..] kthread > [..] ret_from_fork > > tty_ldisc_reinit() should be called with ldisc_sem hold for writing, > which will protect any reader against line discipline changes. > > Cc: Greg Kroah-Hartman > Cc: Jiri Slaby > Cc: sta...@vger.kernel.org # depends on commit b027e2298bd5 ("tty: fix > data race between tty_init_dev and flush of buf") I believe there's a "Fixes" tag for that Fixes: b027e2298bd5 ("tty: fix data race between tty_init_dev and flush of buf") Cc: sta...@vger.kernel.org -ss
Re: [PATCHv2 2/4] tty: Hold tty_ldisc_lock() during tty_reopen()
On (09/03/18 17:52), Dmitry Safonov wrote: > > We've seen the following crash on v4.9.108 stable: > > BUG: unable to handle kernel paging request at 2260 > IP: [..] n_tty_receive_buf_common+0x5f/0x86d > Workqueue: events_unbound flush_to_ldisc > Call Trace: > [..] n_tty_receive_buf2 > [..] tty_ldisc_receive_buf > [..] flush_to_ldisc > [..] process_one_work > [..] worker_thread > [..] kthread > [..] ret_from_fork > > tty_ldisc_reinit() should be called with ldisc_sem hold for writing, > which will protect any reader against line discipline changes. > > Cc: Greg Kroah-Hartman > Cc: Jiri Slaby > Cc: sta...@vger.kernel.org # depends on commit b027e2298bd5 ("tty: fix > data race between tty_init_dev and flush of buf") I believe there's a "Fixes" tag for that Fixes: b027e2298bd5 ("tty: fix data race between tty_init_dev and flush of buf") Cc: sta...@vger.kernel.org -ss