* [PATCH] tty: fix break race [not found] <20260903022452.111316-1-adrianox@gmail.com> @ 2026-09-03 2:24 ` Adriano Cordova 2026-09-03 2:41 ` [syzbot] [usb?] general protection fault in keyspan_break_ctl syzbot 0 siblings, 1 reply; 3+ messages in thread From: Adriano Cordova @ 2026-09-03 2:24 UTC (permalink / raw) To: adrianox; +Cc: Johan Hovold, syzbot+473d7477c523b41d4046, stable A timed break (TCSBRK and TCSBRKP) can race against hangup and end up calling into a tty driver after the underlying device has been removed, for example when a USB serial device is disconnected while a break is in progress. This can result in a use-after-free or NULL-pointer dereference in the driver when the second break_ctl() call is made after the sleep, as reported for the keyspan USB serial driver. Make send_break() wait only for the break duration and then check the hung-up state of the tty before invoking the driver a second time. Since the tty is marked hung up (f_op == &hung_up_tty_fops) before the device is torn down, the second break_ctl() is no longer issued after a hangup and the driver is not called for a device that is gone. Suggested-by: Johan Hovold <johan@kernel.org> Reported-by: syzbot+473d7477c523b41d4046@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=473d7477c523b41d4046 Assisted-by: opencode:deepseek-v4-flash Cc: stable@vger.kernel.org Signed-off-by: Adriano Cordova <adrianox@gmail.com> #syz test --- drivers/tty/tty_io.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c index 48569035da56..c9d8a138b84c 100644 --- a/drivers/tty/tty_io.c +++ b/drivers/tty/tty_io.c @@ -2429,6 +2429,7 @@ static int tiocgetd(struct tty_struct *tty, int __user *p) /** * send_break - performed time break + * @file: file object * @tty: device to break on * @duration: timeout in mS * @@ -2438,7 +2439,7 @@ static int tiocgetd(struct tty_struct *tty, int __user *p) * Locking: * @tty->atomic_write_lock serializes */ -static int send_break(struct tty_struct *tty, unsigned int duration) +static int send_break(struct file *file, struct tty_struct *tty, unsigned int duration) { int retval; @@ -2455,7 +2456,10 @@ static int send_break(struct tty_struct *tty, unsigned int duration) retval = tty->ops->break_ctl(tty, -1); if (!retval) { msleep_interruptible(duration); - retval = tty->ops->break_ctl(tty, 0); + if (tty_hung_up_p(file)) + retval = -EIO; + else + retval = tty->ops->break_ctl(tty, 0); } else if (retval == -EOPNOTSUPP) { /* some drivers can tell only dynamically */ retval = 0; @@ -2727,10 +2731,10 @@ long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg) * This is used by the tcdrain() termios function. */ if (!arg) - return send_break(tty, 250); + return send_break(file, tty, 250); return 0; case TCSBRKP: /* support for POSIX tcsendbreak() */ - return send_break(tty, arg ? arg*100 : 250); + return send_break(file, tty, arg ? arg * 100 : 250); case TIOCMGET: return tty_tiocmget(tty, p); -- 2.51.0 ^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [syzbot] [usb?] general protection fault in keyspan_break_ctl 2026-09-03 2:24 ` [PATCH] tty: fix break race Adriano Cordova @ 2026-09-03 2:41 ` syzbot 0 siblings, 0 replies; 3+ messages in thread From: syzbot @ 2026-09-03 2:41 UTC (permalink / raw) To: adrianox, johan, linux-kernel, stable, syzkaller-bugs Hello, syzbot has tested the proposed patch but the reproducer is still triggering an issue: general protection fault in keyspan_break_ctl Oops: general protection fault, probably for non-canonical address 0xdffffc0000000013: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000098-0x000000000000009f] CPU: 3 UID: 0 PID: 6463 Comm: syz.3.20 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:keyspan_break_ctl+0x8e/0xe0 drivers/usb/serial/keyspan.c:608 Code: ff ff ff e8 24 67 42 fa 83 fb ff 48 b8 00 00 00 00 00 fc ff df 49 8d bc 24 9c 00 00 00 0f 94 c3 48 89 fa 0f b6 db 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 1d 41 RSP: 0018:ffffc9000334fca8 EFLAGS: 00010203 RAX: dffffc0000000000 RBX: 0000000000000001 RCX: ffffffff87c9835c RDX: 0000000000000013 RSI: 00000000ffffffff RDI: 000000000000009c RBP: ffff888059412000 R08: 0000000000000005 R09: 00000000ffffffff R10: 00000000ffffffff R11: 0000000000000000 R12: 0000000000000000 R13: ffff888038a76e00 R14: ffff88802aef6020 R15: ffff88802aef60c8 FS: 00007f62980d46c0(0000) GS:ffff8880d5e61000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f41412c8d58 CR3: 0000000025cea000 CR4: 0000000000352ef0 Call Trace: <TASK> serial_break+0xcb/0x160 drivers/usb/serial/usb-serial.c:538 send_break drivers/tty/tty_io.c:2456 [inline] send_break+0x194/0x3b0 drivers/tty/tty_io.c:2442 tty_ioctl+0xa2f/0x1640 drivers/tty/tty_io.c:2737 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f629719e0d9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f62980d4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f6297425fa0 RCX: 00007f629719e0d9 RDX: 0000000000000000 RSI: 0000000000005425 RDI: 0000000000000004 RBP: 00007f6297235024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f6297426038 R14: 00007f6297425fa0 R15: 00007ffcf04a40e8 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:keyspan_break_ctl+0x8e/0xe0 drivers/usb/serial/keyspan.c:608 Code: ff ff ff e8 24 67 42 fa 83 fb ff 48 b8 00 00 00 00 00 fc ff df 49 8d bc 24 9c 00 00 00 0f 94 c3 48 89 fa 0f b6 db 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 1d 41 RSP: 0018:ffffc9000334fca8 EFLAGS: 00010203 RAX: dffffc0000000000 RBX: 0000000000000001 RCX: ffffffff87c9835c RDX: 0000000000000013 RSI: 00000000ffffffff RDI: 000000000000009c RBP: ffff888059412000 R08: 0000000000000005 R09: 00000000ffffffff R10: 00000000ffffffff R11: 0000000000000000 R12: 0000000000000000 R13: ffff888038a76e00 R14: ffff88802aef6020 R15: ffff88802aef60c8 FS: 00007f62980d46c0(0000) GS:ffff8880d5d61000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055aeb7ddb480 CR3: 0000000025cea000 CR4: 0000000000352ef0 ---------------- Code disassembly (best guess), 2 bytes skipped: 0: ff ljmp (bad) 1: e8 24 67 42 fa call 0xfa42672a 6: 83 fb ff cmp $0xffffffff,%ebx 9: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 10: fc ff df 13: 49 8d bc 24 9c 00 00 lea 0x9c(%r12),%rdi 1a: 00 1b: 0f 94 c3 sete %bl 1e: 48 89 fa mov %rdi,%rdx 21: 0f b6 db movzbl %bl,%ebx 24: 48 c1 ea 03 shr $0x3,%rdx * 28: 0f b6 14 02 movzbl (%rdx,%rax,1),%edx <-- trapping instruction 2c: 48 89 f8 mov %rdi,%rax 2f: 83 e0 07 and $0x7,%eax 32: 83 c0 03 add $0x3,%eax 35: 38 d0 cmp %dl,%al 37: 7c 04 jl 0x3d 39: 84 d2 test %dl,%dl 3b: 75 1d jne 0x5a 3d: 41 rex.B Tested on: commit: 940de590 Merge tag 'hardening-v7.3-rc2' of git://git.k.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=10641f79580000 kernel config: https://syzkaller.appspot.com/x/.config?x=8c5c3949d762a91f dashboard link: https://syzkaller.appspot.com/bug?extid=473d7477c523b41d4046 compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 patch: https://syzkaller.appspot.com/x/patch.diff?x=10f81f79580000 ^ permalink raw reply [flat|nested] 3+ messages in thread
[parent not found: <6a9087a4.4d659fcc.734b4.0013.GAE@google.com>]
* Re: [syzbot] [usb?] general protection fault in keyspan_break_ctl [not found] <6a9087a4.4d659fcc.734b4.0013.GAE@google.com> @ 2026-09-03 14:55 ` syzbot 0 siblings, 0 replies; 3+ messages in thread From: syzbot @ 2026-09-03 14:55 UTC (permalink / raw) To: adrianox, gregkh, jirislaby, johan, kartikey406, linux-kernel, linux-serial, linux-usb, stable, syzkaller-bugs syzbot has found a reproducer for the following issue on: HEAD commit: 940de590b839 Merge tag 'hardening-v7.3-rc2' of git://git.k.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=13537c15580000 kernel config: https://syzkaller.appspot.com/x/.config?x=85bc5cc2fc7394d9 dashboard link: https://syzkaller.appspot.com/bug?extid=473d7477c523b41d4046 compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 userspace arch: i386 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11f19f79580000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15ed50f9580000 Downloadable assets: disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-940de590.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/f3f674f98efb/vmlinux-940de590.xz kernel image: https://storage.googleapis.com/syzbot-assets/132222426e71/bzImage-940de590.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+473d7477c523b41d4046@syzkaller.appspotmail.com Oops: general protection fault, probably for non-canonical address 0xdffffc0000000013: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000098-0x000000000000009f] CPU: 0 UID: 0 PID: 6007 Comm: syz.2.19 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:keyspan_break_ctl+0x8e/0xe0 drivers/usb/serial/keyspan.c:608 Code: ff ff ff e8 74 88 43 fa 83 fb ff 48 b8 00 00 00 00 00 fc ff df 49 8d bc 24 9c 00 00 00 0f 94 c3 48 89 fa 0f b6 db 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 1d 41 RSP: 0018:ffffc900067ffc50 EFLAGS: 00010203 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff87c7ae2c RDX: 0000000000000013 RSI: 00000000ffffffff RDI: 000000000000009c RBP: ffff888013d9a000 R08: 0000000000000005 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: ffff88804a94d020 R14: ffff88804a94d0c8 R15: 0000000000000007 FS: 0000000000000000(0000) GS:ffff888096967000(0063) knlGS:0000000056ebd480 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 00000000ffdb3ff0 CR3: 00000000529f7000 CR4: 0000000000352ef0 Call Trace: <TASK> serial_break+0xcb/0x160 drivers/usb/serial/usb-serial.c:538 send_break drivers/tty/tty_io.c:2458 [inline] send_break+0x2ec/0x370 drivers/tty/tty_io.c:2441 tty_ioctl+0xa2c/0x1640 drivers/tty/tty_io.c:2733 tty_compat_ioctl+0x87/0x420 drivers/tty/tty_io.c:2931 __do_compat_sys_ioctl fs/ioctl.c:695 [inline] __se_compat_sys_ioctl fs/ioctl.c:638 [inline] __ia32_compat_sys_ioctl+0x2cf/0x360 fs/ioctl.c:638 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline] __do_fast_syscall_32+0x13a/0x8b0 arch/x86/entry/syscall_32.c:291 do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:316 entry_SYSENTER_compat_after_hwframe+0x84/0x8e RIP: 0023:0xf702efec Code: Unable to access opcode bytes at 0xf702efc2. RSP: 002b:00000000ff93915c EFLAGS: 00000296 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000005425 RDX: 0000000000000007 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:keyspan_break_ctl+0x8e/0xe0 drivers/usb/serial/keyspan.c:608 Code: ff ff ff e8 74 88 43 fa 83 fb ff 48 b8 00 00 00 00 00 fc ff df 49 8d bc 24 9c 00 00 00 0f 94 c3 48 89 fa 0f b6 db 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 1d 41 RSP: 0018:ffffc900067ffc50 EFLAGS: 00010203 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff87c7ae2c RDX: 0000000000000013 RSI: 00000000ffffffff RDI: 000000000000009c RBP: ffff888013d9a000 R08: 0000000000000005 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: ffff88804a94d020 R14: ffff88804a94d0c8 R15: 0000000000000007 FS: 0000000000000000(0000) GS:ffff888096a67000(0063) knlGS:0000000056ebd480 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 00000000f7349bcc CR3: 00000000529f7000 CR4: 0000000000352ef0 ---------------- Code disassembly (best guess), 2 bytes skipped: 0: ff ljmp (bad) 1: e8 74 88 43 fa call 0xfa43887a 6: 83 fb ff cmp $0xffffffff,%ebx 9: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 10: fc ff df 13: 49 8d bc 24 9c 00 00 lea 0x9c(%r12),%rdi 1a: 00 1b: 0f 94 c3 sete %bl 1e: 48 89 fa mov %rdi,%rdx 21: 0f b6 db movzbl %bl,%ebx 24: 48 c1 ea 03 shr $0x3,%rdx * 28: 0f b6 14 02 movzbl (%rdx,%rax,1),%edx <-- trapping instruction 2c: 48 89 f8 mov %rdi,%rax 2f: 83 e0 07 and $0x7,%eax 32: 83 c0 03 add $0x3,%eax 35: 38 d0 cmp %dl,%al 37: 7c 04 jl 0x3d 39: 84 d2 test %dl,%dl 3b: 75 1d jne 0x5a 3d: 41 rex.B --- If you want syzbot to run the reproducer, reply with: #syz test: git://repo/address.git branch-or-commit-hash If you attach or paste a git patch, syzbot will apply it before testing. ^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-09-03 14:55 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <20260903022452.111316-1-adrianox@gmail.com>
2026-09-03 2:24 ` [PATCH] tty: fix break race Adriano Cordova
2026-09-03 2:41 ` [syzbot] [usb?] general protection fault in keyspan_break_ctl syzbot
[not found] <6a9087a4.4d659fcc.734b4.0013.GAE@google.com>
2026-09-03 14:55 ` syzbot
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox