linux-kernel - Re: 2.6.31-rc5 regression: Oops when USB Serial disconnected while in use

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.44L0.0908211326120.4029-100000@iolanthe.rowland.org>
Date:	Fri, 21 Aug 2009 13:39:53 -0400 (EDT)
From:	Alan Stern <stern@...land.harvard.edu>
To:	Alan Cox <alan@...rguk.ukuu.org.uk>
cc:	Bruno Prémont <bonbons@...ux-vserver.org>,
	Greg KH <greg@...ah.com>,
	Kernel development list <linux-kernel@...r.kernel.org>,
	USB list <linux-usb@...r.kernel.org>,
	"Rafael J. Wysocki" <rjw@...k.pl>
Subject: Re: 2.6.31-rc5 regression: Oops when USB Serial disconnected while
 in use

On Fri, 21 Aug 2009, Alan Cox wrote:

> > Alan, related to this problem is the fact that usb_serial_driver
> > doesn't include a "hangup" method.  I'm not sure that making
> > serial_hangup() call serial_do_down() is correct, but if it is then
> > shouldn't we call port->serial->type->open() afterwards?  Otherwise the
> > lower driver can't know that the port is still open.
> 
> After a hangup the port isn't open (at the physical level anyway). It may
> be re-opened by another open() call later

Or, oddly enough, another open() call earlier...

> but the original user lost
> access to it and shouldn't touch the h/w post hangup completion.

Then surely serial_open() should call serial->type->open() _after_ 
tty_port_block_til_ready(), not before.

> > Furthermore, shouldn't we check ASYNCB_INITIALIZED in serial_close()?
> 
> Possibly - I was in the middle of debugging the newest bits when Linus
> annoyed me. Certainly there are issues in the current code if you get
> a hangup while waiting for open to complete. I fixed that in the patches
> I sent Greg but didn't finish debugging it.

Well, yes.  The way it is now, you get:

	serial_open()				/* first user */
		serial->type->open()		/* initializes the hardware */
		tty_port_block_til_ready()	/* returns immediately */

	serial_open()				/* second user */
		serial->type->open skipped because the port
			is already open
		tty_port_block_til_ready()	/* blocks */

	serial_hangup()				/* first connection drops */
		serial_do_down()
			serial->type-close()	/* resets the hardware */

		... tty_port_block_til_ready() returns

Now the second user tries to do stuff but the hardware isn't ready.  
Instead this should go:

	serial_open()				/* first user */
		tty_port_block_til_ready()	/* returns immediately */
		serial->type->open()		/* initializes the hardware */

	serial_open()				/* second user */
		tty_port_block_til_ready()	/* blocks */

	serial_hangup()				/* first connection drops */
		serial_do_down()
			serial->type-close()	/* resets the hardware */

		... tty_port_block_til_ready() returns
		serial->type->open()		/* not skipped */

Now the second user can proceed to use the hardware.  Or have I 
misunderstood how this is intended to work?

Alan Stern

P.S.: Can you explain the reason why tty_port and tty_struct are two 
separate structures?  Isn't the same port always associated with the 
same tty?

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/