From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6EC9DC77B73 for ; Thu, 27 Apr 2023 07:58:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243196AbjD0H63 (ORCPT ); Thu, 27 Apr 2023 03:58:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60488 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242899AbjD0H61 (ORCPT ); Thu, 27 Apr 2023 03:58:27 -0400 Received: from smtp-out2.suse.de (smtp-out2.suse.de [195.135.220.29]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B5ACA1B9; Thu, 27 Apr 2023 00:58:26 -0700 (PDT) Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by smtp-out2.suse.de (Postfix) with ESMTPS id 740BE1FDE6; Thu, 27 Apr 2023 07:58:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_rsa; t=1682582305; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=GuUVcD38jAMovH64SkqQKxX5RN0P/+TAtv2rdAFVBZ8=; b=K6krzc3Liq3pUZjrA4chMtyqEZDkzcf0QkorM+i6l6FyLZgzipB6U/HsVINMSoW6lCE5V2 HwwshR8HOVWapMlJziDedAGlp/1KsArcUlX4PQOwUzemsVR96qFT3hpVNx412BoBvIhB0w 05rUwGrmxdxK+pdAgVMrQ5O8jh0cgEY= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_ed25519; t=1682582305; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=GuUVcD38jAMovH64SkqQKxX5RN0P/+TAtv2rdAFVBZ8=; b=AIZSk5c5RYTrgBpek0Ji9NMeTkNfmkc+jVxQs6HA8Tz5EfhPRI/ZsqjXdZRBRSuMB7oAeY Xtij/Cpz1/1kWkAQ== Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by imap2.suse-dmz.suse.de (Postfix) with ESMTPS id 4EE2D13910; Thu, 27 Apr 2023 07:58:25 +0000 (UTC) Received: from dovecot-director2.suse.de ([192.168.254.65]) by imap2.suse-dmz.suse.de with ESMTPSA id 1zdJEiErSmRmQwAAMHmgww (envelope-from ); Thu, 27 Apr 2023 07:58:25 +0000 Date: Thu, 27 Apr 2023 09:58:24 +0200 Message-ID: <87bkj9u57j.wl-tiwai@suse.de> From: Takashi Iwai To: Yu Hao Cc: mchehab@kernel.org, linux-media@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: BUG: WARNING in dvb_frontend_get_event In-Reply-To: References: User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/27.2 Mule/6.0 MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, 18 Apr 2023 06:50:07 +0200, Yu Hao wrote: > > Hello, > > We found the following issue using syzkaller on Linux v6.2.0. > > In the function `dvb_frontend_get_event`, function > `wait_event_interruptible` is called > and the condition is `dvb_frontend_test_event(fepriv, events)`. > In the function `dvb_frontend_test_event`, function > `down(&fepriv->sem);` is called. > However, function `wait_event_interruptible` would put the process to sleep. > And function `down(&fepriv->sem);` may block the process. > So there is the issue with "do not call blocking ops when !TASK_RUNNING". > > The full report including the Syzkaller reproducer & C reproducer: > https://gist.github.com/ZHYfeng/4c5f8be6adc63b73dba68230d15ece2c FYI, CVE-2023-31084 was assigned to this bug, and I was involved now though distro's bug report. So, the use of semaphore together with wait_event*() macro doesn't look like a good idea. A possible easy workaround would be to open-code the wait loop like below. Mauro, let me know if it's an acceptable workaround. Then I'll submit a proper patch. thanks, Takashi -- 8< -- --- a/drivers/media/dvb-core/dvb_frontend.c +++ b/drivers/media/dvb-core/dvb_frontend.c @@ -293,14 +293,22 @@ static int dvb_frontend_get_event(struct dvb_frontend *fe, } if (events->eventw == events->eventr) { - int ret; + struct wait_queue_entry wait; + int ret = 0; if (flags & O_NONBLOCK) return -EWOULDBLOCK; - ret = wait_event_interruptible(events->wait_queue, - dvb_frontend_test_event(fepriv, events)); - + init_waitqueue_entry(&wait, current); + add_wait_queue(&events->wait_queue, &wait); + while (!dvb_frontend_test_event(fepriv, events)) { + wait_woken(&wait, TASK_INTERRUPTIBLE, 0); + if (signal_pending(current)) { + ret = -ERESTARTSYS; + break; + } + } + remove_wait_queue(&events->wait_queue, &wait); if (ret < 0) return ret; }