linux-kernel - [PATCH v3 15/23] tty: Don't restart ldisc on hangup if racing ldisc kill

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue,  5 Feb 2013 15:20:30 -0500
From:	Peter Hurley <peter@...leysoftware.com>
To:	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Alan Cox <alan@...ux.intel.com>, Jiri Slaby <jslaby@...e.cz>,
	Sasha Levin <levinsasha928@...il.com>,
	Sebastian Andrzej Siewior <bigeasy@...utronix.de>
Cc:	linux-serial@...r.kernel.org, linux-kernel@...r.kernel.org,
	Ilya Zykov <ilya@...x.ru>, Dave Jones <davej@...hat.com>,
	Peter Hurley <peter@...leysoftware.com>
Subject: [PATCH v3 15/23] tty: Don't restart ldisc on hangup if racing ldisc kill

Asynchronous hangups (such as from carrier loss) can race with the
final tty release. Because there is no mechanism to prevent an async
hangup from being scheduled, waiting for the hangup to complete is
insufficient to prevent racing between ldisc hangup and ldisc kill.
Eg., immediately after flush_work() returns, an async hangup
could be scheduled, thus restarting a new ldisc.

Instead, prevent hangup from restarting a new ldisc when the tty is
being destroyed.

Signed-off-by: Peter Hurley <peter@...leysoftware.com>
---
 drivers/tty/tty_ldisc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c
index 8a86a72..e0fdfec 100644
--- a/drivers/tty/tty_ldisc.c
+++ b/drivers/tty/tty_ldisc.c
@@ -884,7 +884,7 @@ void tty_ldisc_hangup(struct tty_struct *tty)
 	 * Shutdown the current line discipline, and reset it to
 	 * N_TTY if need be.
 	 *
-	 * Avoid racing set_ldisc or tty_ldisc_release
+	 * Avoid racing set_ldisc or tty_ldisc_kill
 	 */
 	mutex_lock(&tty->ldisc_mutex);
 
@@ -892,7 +892,7 @@ void tty_ldisc_hangup(struct tty_struct *tty)
 	   reopen it. We could defer this to the next open but
 	   it means auditing a lot of other paths so this is
 	   a FIXME */
-	if (tty_ldisc_hangup_halt(tty)) {
+	if (tty_ldisc_hangup_halt(tty) && !test_bit(TTY_CLOSING, &tty->flags)) {
 		if (reset == 0) {
 
 			if (!tty_ldisc_reinit(tty, tty->termios.c_line))
-- 
1.8.1.2

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/