"value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntty: fix deadlock caused by calling printk() under tty_port->lock\n\npty_write() invokes kmalloc() which may invoke a normal printk() to print\nfailure message. This can cause a deadlock in the scenario reported by\nsyz-bot below:\n\n CPU0 CPU1 CPU2\n ---- ---- ----\n lock(console_owner);\n lock(&port_lock_key);\n lock(&port->lock);\n lock(&port_lock_key);\n lock(&port->lock);\n lock(console_owner);\n\nAs commit dbdda842fe96 (\"printk: Add console owner and waiter logic to\nload balance console writes\")said,suchdeadlockcanbepreventedby\nusingprintk_deferred()inkmalloc()(whichisinvokedinthesection\nguardedbytheport->lock).Buttherearetoomanyprintk()onthe\nkmalloc()path,andkmalloc()canbecalledfromanywhere,sochanging\nprintk()toprintk_deferred()istoocomplicatedandinelegant.\n\nTherefore,thispatchchoosestospecify__GFP_NOWARNtokmalloc(),so\nthatprintk()willnotbecalled,andthisdeadlockproblemcanbe\navoided.\n\nSyzbotreportedthefollowinglockdeperror:\n\n======================================================\nWARNING:possiblecircularlockingdependencydetected\n5.4.143-00237-g08ccc19a-dirty#10Nottainted\n------------------------------------------------------\nsyz-executor.4/29420istryingtoacquirelock:\nffffffff8aedb2a0(console_owner){....}-{0:0},at:console_trylock_spinningkernel/printk/printk.c:1752[inline]\nffffffff8aedb2a0(console_owner){....}-{0:0},at:vprintk_emit+0x2ca/0x470kernel/printk/printk.c:2023\n\nbuttaskisalreadyholdinglock:\nffff8880119c9158(&port->lock){-.-.}-{2:2},at:pty_write+0xf4/0x1f0drivers/tty/pty.c:120\n\nwhichlockalreadydependsonthenewlock.\n\ntheexistingdependencychain(inreverseorder)is:\n\n->#2(&port->lock){-.-.}-{2:2}:\n__raw_spin_lock_irqsaveinclude/linux/spinlock_api_smp.h:110[inline]\n_raw_spin_lock_irqsave+0x35/0x50kernel/locking/spinlock.c:159\ntty_port_tty_getdrivers/tty/tty_port.c:288[inline]\t\t<--lock(&port->lock);\ntty_port_default_wakeup+0x1d/0xb0drivers/tty/tty_port.c:47\nserial8250_tx_chars+0x530/0xa80drivers/tty/serial/8250/8250_port.c:1767\nserial8250_handle_irq.part.0+0x31f/0x3d0drivers/tty/serial/8250/8250_port.c:1854\nserial8250_handle_irqdrivers/tty/serial/8250/8250_port.c:1827[inline]\t<--lock(&port_lock_key);\nserial8250_default_handle_irq+0xb2/0x220drivers/tty/serial/8250/8250_port.c:1870\nserial8250_interrupt+0xfd/0x200drivers/tty/serial/8250/8250_core.c:126\n__handle_irq_event_percpu+0x109/0xa50kernel/irq/handle.c:156\n[...]\n\n->#1(&port_lock_key){-.-.}-{2:2}:\n__raw_spin_lock_irqsaveinclude/linux/spinlock_api_smp.h:110[inline]\n_raw_spin_lock_irqsave+0x35/0x50kernel/locking/spinlock.c:159\nserial8250_console_write+0x184/0xa40drivers/tty/serial/8250/8250_port.c:3198\n\t\t\t\t\t\t\t\t\t\t<--lock(&port_lock_key);\ncall_console_driverskernel/printk/printk.c:1819[inline]\nconsole_unlock+0x8cb/0xd00kernel/printk/printk.c:2504\nvprintk_emit+0x1b5/0x470kernel/printk/printk.c:2024\t\t\t<--lock(console_owner);\nvprintk_func+0x8d/0x250kernel/printk/printk_safe.c:394\nprintk+0xba/0xedkernel/printk/printk.c:2084\nregister_console+0x8b3/0xc10kernel/printk/printk.c:2829\nuniv8250_console_init+0x3a/0x46drivers/tty/serial/8250/8250_core.c:681\nconsole_init+0x49d/0x6d3kernel/printk/printk.c:2915\nstart_kernel+0x5e9/0x879init/main.c:713\nsecondary_startup_64+0xa4/0xb0arch/x86/kernel/head_64.S:241\n\n->#0(console_owner){....}-{0:0}:\n[...]\nlock_acquire+0x127/0x340kernel/locking/lockdep.c:4734\nconsole_trylock_spinningkernel/printk/printk.c:1773\n
"value":"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tty: se corrige el bloqueo causado por llamar a printk() bajo tty_port->lock pty_write() invoca kmalloc() que puede invocar un printk() normal para imprimir un mensaje de error. Esto puede causar un bloqueo en el escenario informado por syz-bot a continuaci\u00f3n: CPU0 CPU1 CPU2 ---- ---- ---- lock(console_owner); lock(&port_lock_key); lock(&port->lock); lock(&port_lock_key); lock(&port->lock); lock(console_owner); Como dijo el commit dbdda842fe96 (\"printk: Agregar l\u00f3gica de propietario y espera de consola para equilibrar la carga de escrituras de consola\"), dicho bloqueo se puede prevenir usando printk_deferred() en kmalloc() (que se invoca en la secci\u00f3n protegida por port->lock). Pero hay demasiados printk() en la ruta kmalloc() y kmalloc() se puede llamar desde cualquier lugar, por lo que cambiar printk() a printk_deferred() es demasiado complicado y poco elegante. Por lo tanto, este parche elige especificar __GFP_NOWARN en kmalloc(), de modo que no se llame a printk() y se pueda evitar este problema de bloqueo. Syzbot inform\u00f3 el siguiente error de lockdep: ======================================================== ADVERTENCIA: posible dependencia de bloqueo circular detectada 5.4.143-00237-g08ccc19a-dirty #10 Not tainted ------------------------------------------------------ syz-executor.4/29420 is trying to acquire lock: ffffffff8aedb2a0 (console_owner){....}-{0:0}, at: console_trylock_spinning kernel/printk/printk.c:1752 [inline] ffffffff8aedb2a0 (console_owner){....}-{0:0}, at: vprintk_emit+0x2ca/0x470 kernel/printk/printk.c:2023 but task is already holding lock: ffff8880119c9158 (&port->lock){-.-.}-{2:2}, at: pty_write+0xf4/0x1f0 drivers/tty/pty.c:120 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (&port->lock){-.-.}-{2:2}: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x35/0x50 kernel/locking/spinlock.c:159 tty_port_tty_get drivers/tty/tty_port.c:288 [inline] <-- lock(&port->lock); tty_port_default_wakeup+0x1d/0xb0 drivers/tty/tty_port.c:47 serial8250_tx_chars+0x530/0xa80 drivers/tty/serial/8250/8250_port.c:1767 serial8250_handle_irq.part.0+0x31f/0x3d0 drivers/tty/serial/8250/8250_port.c:1854 serial8250_handle_irq drivers/tty/serial/8250/8250_port.c:1827 [inline] <-- lock(&port_lock_key); serial8250_default_handle_irq+0xb2/0x220 drivers/tty/serial/8250/8250_port.c:1870 serial8250_interrupt+0xfd/0x200 drivers/tty/serial/8250/8250_core.c:126 __handle_irq_event_percpu+0x109/0xa50 kernel/irq/handle.c:156 [...] -> #1 (&port_lock_key){-.-.}-{2:2}: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x35/0x50 kernel/locking/spinlock.c:159 serial8250_console_write+0x184/0xa40 drivers/tty/serial/8250/8250_port.c:3198 <-- lock(&port_lock_key); call_console_drivers kernel/printk/printk.c:1819 [inline] console_unlock+0x8cb/0xd00 kernel/printk/printk.c:2504 vprintk_emit+0x1b5/0x470 kernel/printk/printk.c:2024 <-- lock(console_owner); vprintk_func+0x8d/0x250 kernel/printk/printk_safe.c:394 printk+0xba/0xed kernel/printk/printk.c:2084 register_console+0x8b3/0xc10 kernel/printk/printk.c:2829 univ8250_console_init+0x3a/0x46 drivers/tty/serial/8250/8250_core.c:681 console_init+0x49d/0x6d3 kernel/printk/printk.c:2915 start_kernel+0x5e9/0x879 init/main.c:713 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:241 -> #0 (console_owner){....}-{0:0}: [...] lock_acquire+0x127/0x340 kernel/locking/lockdep.c:4734 console_trylock_spinning kernel/printk/printk.c:1773 ---truncated--- "
