• Tetsuo Handa's avatar
    n_tty: Access echo_* variables carefully. · ebec3f8f
    Tetsuo Handa authored
    syzbot is reporting stalls at __process_echoes() [1]. This is because
    since ldata->echo_commit < ldata->echo_tail becomes true for some reason,
    the discard loop is serving as almost infinite loop. This patch tries to
    avoid falling into ldata->echo_commit < ldata->echo_tail situation by
    making access to echo_* variables more carefully.
    
    Since reset_buffer_flags() is called without output_lock held, it should
    not touch echo_* variables. And omit a call to reset_buffer_flags() from
    n_tty_open() by using vzalloc().
    
    Since add_echo_byte() is called without output_lock held, it needs memory
    barrier between storing into echo_buf[] and incrementing echo_head counter.
    echo_buf() needs corresponding memory barrier before reading echo_buf[].
    Lack of handling the possibility of not-yet-stored multi-byte operation
    might be the reason of falling into ldata->echo_commit < ldata->echo_tail
    situation, for if I do WARN_ON(ldata->echo_commit == tail + 1) prior to
    echo_buf(ldata, tail + 1), the WARN_ON() fires.
    
    Also, explicitly masking with buffer for the former "while" loop, and
    use ldata->echo_commit > tail for the latter "while" loop.
    
    [1] https://syzkaller.appspot.com/bug?id=17f23b094cd80df750e5b0f8982c521ee6bcbf40Signed-off-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
    Reported-by: default avatarsyzbot <syzbot+108696293d7a21ab688f@syzkaller.appspotmail.com>
    Cc: Peter Hurley <peter@hurleysoftware.com>
    Cc: stable <stable@vger.kernel.org>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    ebec3f8f
n_tty.c 61.1 KB