linux-kernel - Re: [PATCH] tty: fix flush_to_ldisc() oops before tty

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 25 Oct 2017 20:25:29 +0100
From:   Alan Cox <gnomes@...rguk.ukuu.org.uk>
To:     taoyuhong <taoyuhong@...wei.com>
Cc:     <gregkh@...uxfoundation.org>, <jslaby@...e.com>,
        <zhaoshenglong@...wei.com>, <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] tty: fix flush_to_ldisc() oops before tty_open is done

> When tty_open() is opening a serial tty at the first time, after
> alloc_tty_struct() is called, before tty->ops->open() is finished.

That's kind of unavoidable.

> Serial driever like pl011 on ARM is ready to setup kworker threads
> to receive data with flush_to_ldisc(). Serial input at this time
> window can trigger kernel oops.

So you shouldn't be queueing I/O at this point.

> On the other side, flush_to_ldisc() can also oops on a hung-up tty.

flush_to_ldisc takes a reference to the tty ldisc so when it's called
from tty_schedule_flip all should be good. 

> Serial driver may has problem, but tty driver can easily handle these 2
> oops problems by:
> 
> 1. Skip data transfer of hung-up tty, in flush_to_ldisc()

No because you may have data you need to drain. If the tty has become
null then the data is dropped anyway, likewise if there is no bound ldisc
to send it to.

> 2. Mark hungup to tty_struct created by tty_openi(), which will be cleaned
>    at the end of tty_open().

You shouldn't be looking at the tty structure, the tty structure is an
object whose lifetime is not aligned to your port. You should be looking
in the tty port structure.

Your port->ops->activate() is called at the point when your port is
activated, and you have other port methods to handle the other cases if
you need to synchronize with them.

Alan