linux-kernel - [PATCH 1/2] usb console: fix kernel crash on stty -a

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1252184918-9577-2-git-send-email-jason.wessel@windriver.com>
Date:	Sat,  5 Sep 2009 16:08:37 -0500
From:	Jason Wessel <jason.wessel@...driver.com>
To:	gregkh@...e.de, torvalds@...ux-foundation.org
Cc:	linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org,
	Jason Wessel <jason.wessel@...driver.com>,
	Alan Stern <stern@...land.harvard.edu>
Subject: [PATCH 1/2] usb console: fix kernel crash on stty -a < /dev/ttyUSB0

* Boot with the kernel argument console=ttyUSB0,9600
* Run: stty -a < /dev/ttyUSB0
* Immediately you get an oops warning, which later leads to a hard
  kernel crash

The commit 335f8514f200e63d689113d29cb7253a5c282967 created the
original regression and commit
6e4061210150d1d6d388c5fba05f6b49a306a27e only fixed part of the
problem.

Only protect the serial->type->open() from getting executed when the
device is used as a console.

The wider scope of the console protection added in
6e4061210150d1d6d388c5fba05f6b49a306a27e causes the logic in
serial_open() to fall through and zero out the port->port.count with
the stty sys call.  Once the port.count is zeroed the HW will get
closed while other drivers still have call backs to a non-initialized
device which crashes the kernel.

Signed-off-by: Jason Wessel <jason.wessel@...driver.com>
Cc: Greg KH <gregkh@...e.de>
Cc: Alan Stern <stern@...land.harvard.edu>

---
 drivers/usb/serial/usb-serial.c |   17 ++++++++++-------
 1 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index 99188c9..7ca4ced 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -223,8 +223,7 @@ static int serial_open (struct tty_struct *tty, struct file *filp)
 	tty->driver_data = port;
 	tty_port_tty_set(&port->port, tty);
 
-	/* If the console is attached, the device is already open */
-	if (port->port.count == 1 && !port->console) {
+	if (port->port.count == 1) {
 		first = 1;
 		/* lock this module before we call it
 		 * this may fail, which means we must bail out,
@@ -242,11 +241,15 @@ static int serial_open (struct tty_struct *tty, struct file *filp)
 		if (retval)
 			goto bailout_module_put;
 
-		/* only call the device specific open if this
-		 * is the first time the port is opened */
-		retval = serial->type->open(tty, port, filp);
-		if (retval)
-			goto bailout_interface_put;
+		/* only call the device specific open if this is the
+		 * first time the port is opened and it is not a
+		 * console port where the HW has already been
+		 * initialized */
+		if (!port->console) {
+			retval = serial->type->open(tty, port, filp);
+			if (retval)
+				goto bailout_interface_put;
+		}
 		mutex_unlock(&serial->disc_mutex);
 		set_bit(ASYNCB_INITIALIZED, &port->port.flags);
 	}
-- 
1.6.3.1.9.g95405b

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/