linux-kernel - Re: [PATCH 4/7] hvc_console: Fix race between hvc_close and hvc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 26 Mar 2010 18:13:40 +0530
From:	Amit Shah <amit.shah@...hat.com>
To:	Sachin Sant <sachinp@...ibm.com>
Cc:	Benjamin Herrenschmidt <benh@...nel.crashing.org>,
	Greg Kroah-Hartman <gregkh@...e.de>, a.p.zijlstra@...llo.nl,
	Rusty Russell <rusty@...tcorp.com.au>,
	linux-kernel@...r.kernel.org, linuxppc-dev@...abs.org,
	Anton Blanchard <anton@...ba.org>, tglx@...utronix.de,
	Linus Torvalds <torvalds@...ux-foundation.org>, mingo@...e.hu,
	Alan Cox <alan@...rguk.ukuu.org.uk>
Subject: Re: [PATCH 4/7] hvc_console: Fix race between hvc_close and
	hvc_remove

On (Fri) Mar 26 2010 [17:12:22], Sachin Sant wrote:
> Amit Shah wrote:
>> On (Fri) Mar 26 2010 [14:43:56], Sachin Sant wrote:
>>   
>>>> And this suggests that hvc_kick() is called before hvc_task is
>>>> initialised, ie, before hvc_init() is called.
>>>>
>>>> Does this help?
>>>>         
>>> Hi Amit,
>>>
>>> I too ran into this issue as reported by Anton. Unfortunately in my
>>> case the following suggested patch does not help boot the powerpc
>>> box successfully. The boot still hangs with following messages
>>>     
>>
>> Was the hang you saw before applying this patch at the same place / for
>> the same reason?
>>   
> Yes the machine hangs at the same place with or without the patch.

OK.

>>> mount: can't find /root/proc in /etc/fstab or /etc/mtab
>>> /sbin/smart_agetty: can not determine 'console' speed
>>>     
>>
>> OK, this gets even murkier. I don't know why taking a few krefs modifies
>> hvc_console behaviour to such an extent.
>>   
> Looking at the commit e74d098c66543d0731de62eb747ccd5b636a6f4c,
> i see that for every tty_kref_get() there is a corresponding
> tty_kref_put() except maybe for the one in the following patch snippet
>
>        spin_lock_irqsave(&hp->lock, flags);
>        /* Check and then increment for fast path open. */
>        if (hp->count++ > 0) {
> +               tty_kref_get(tty);
>                spin_unlock_irqrestore(&hp->lock, flags);
>                hvc_kick();
>                return 0;
>
> I don't know this code very well but we might be missing a
> corresponding tty_kref_put() some place ?

See hvc_hangup:

	temp_open_count = hp->count;
	...
	while(temp_open_count) {
		--temp_open_count;
		tty_kref_put(tty);
		kref_put(&hp->kref, destroy_hvc_struct);
	}

> If i comment out the above tty_kref_get() call, the machine
> boots fine with or without the suggested patch.

Hm, so as Alan suggests, it could be a timing issue in getting the ref
and returning back from hvc_open(). I don't know how the tty layer
works, but delays in getting the open() succeed results in badness?
Guess we'll have to poke at the other drivers to see how they handle
open() calls.

		Amit
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/