linux-kernel - [PATCH 1/1] TTY: pdc_cons, fix regression in close

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sat,  5 May 2012 22:49:10 +0200
From:	Jiri Slaby <jslaby@...e.cz>
To:	gregkh@...uxfoundation.org
Cc:	gmsof@...icoman.be, torvalds@...ux-foundation.org,
	linux-kernel@...r.kernel.org, jirislaby@...il.com,
	Kyle McMartin <kyle@...artin.ca>, Helge Deller <deller@....de>,
	"James E.J. Bottomley" <jejb@...isc-linux.org>
Subject: [PATCH 1/1] TTY: pdc_cons, fix regression in close

The test in pdc_console_tty_close '!tty->count' was always wrong
because tty->count is decremented after tty->ops->close is called and
thus can never be zero. Hence the 'then' branch was never executed and
the timer never deleted.

This did not matter until 5dd5bc40f3b6e0ccdaad948dbadc94ad0906cb25
(TTY: pdc_cons, use tty_port). There we needed to set TTY in tty_port
to NULL, but this never happened due to the bug above.

So change the test to really trigger at the last close by changing the
condition to 'tty->count == 1'.

Well, the driver should not touch tty->count at all. It should use
tty_port->count and count open count there itself.

Signed-off-by: Jiri Slaby <jslaby@...e.cz>
Reported-and-tested-by: Mikulas Patocka <mpatocka@...hat.com>
Cc: Kyle McMartin <kyle@...artin.ca>
Cc: Helge Deller <deller@....de>
Cc: "James E.J. Bottomley" <jejb@...isc-linux.org>
---
 arch/parisc/kernel/pdc_cons.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/parisc/kernel/pdc_cons.c b/arch/parisc/kernel/pdc_cons.c
index 4f00459..0b33933 100644
--- a/arch/parisc/kernel/pdc_cons.c
+++ b/arch/parisc/kernel/pdc_cons.c
@@ -104,7 +104,7 @@ static int pdc_console_tty_open(struct tty_struct *tty, struct file *filp)

 static void pdc_console_tty_close(struct tty_struct *tty, struct file *filp)
 {
-	if (!tty->count) {
+	if (tty->count == 1) {
 		del_timer_sync(&pdc_console_timer);
 		tty_port_tty_set(&tty_port, NULL);
 	}
-- 
1.7.9.2

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/