linux-kernel - Re: linux-next: Tree for Aug 1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 1 Aug 2017 15:28:32 +0200
From:   Arnd Bergmann <arnd@...db.de>
To:     Sergey Senozhatsky <sergey.senozhatsky.work@...il.com>
Cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Linux-Next Mailing List <linux-next@...r.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Stephen Rothwell <sfr@...b.auug.org.au>,
        Sergey Senozhatsky <sergey.senozhatsky@...il.com>
Subject: Re: linux-next: Tree for Aug 1

On Tue, Aug 1, 2017 at 3:20 PM, Arnd Bergmann <arnd@...db.de> wrote:
> On Tue, Aug 1, 2017 at 2:42 PM, Sergey Senozhatsky
> <sergey.senozhatsky.work@...il.com> wrote:
>> Hello,
>>
>>
>> seems that commit 979990c6284814617 ("tty: improve tty_insert_flip_char()
>> fast path") panics my kernel.
>>
>> in particular, this part
>
> Looking into it now, sorry for the breakage.

Does this fix it? I definitely got this part wrong as I see now, we must
look up the 'tail' after calling __tty_buffer_request_room, not before.

      Arnd

diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c
index 6a8563633d4b..f8eba1c5412f 100644
--- a/drivers/tty/tty_buffer.c
+++ b/drivers/tty/tty_buffer.c
@@ -372,12 +372,13 @@ EXPORT_SYMBOL(tty_insert_flip_string_flags);
  */
 int __tty_insert_flip_char(struct tty_port *port, unsigned char ch, char flag)
 {
-       struct tty_buffer *tb = port->buf.tail;
+       struct tty_buffer *tb;
        int flags = (flag == TTY_NORMAL) ? TTYB_NORMAL : 0;

        if (!__tty_buffer_request_room(port, 1, flags))
                return 0;

+       tb = port->buf.tail;
        if (~tb->flags & TTYB_NORMAL)
                *flag_buf_ptr(tb, tb->used) = flag;
        *char_buf_ptr(tb, tb->used++) = ch;