lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date:   Wed, 25 Oct 2017 20:25:29 +0100
From:   Alan Cox <>
To:     taoyuhong <>
Cc:     <>, <>,
        <>, <>
Subject: Re: [PATCH] tty: fix flush_to_ldisc() oops before tty_open is done

> When tty_open() is opening a serial tty at the first time, after
> alloc_tty_struct() is called, before tty->ops->open() is finished.

That's kind of unavoidable.

> Serial driever like pl011 on ARM is ready to setup kworker threads
> to receive data with flush_to_ldisc(). Serial input at this time
> window can trigger kernel oops.

So you shouldn't be queueing I/O at this point.

> On the other side, flush_to_ldisc() can also oops on a hung-up tty.

flush_to_ldisc takes a reference to the tty ldisc so when it's called
from tty_schedule_flip all should be good. 

> Serial driver may has problem, but tty driver can easily handle these 2
> oops problems by:
> 1. Skip data transfer of hung-up tty, in flush_to_ldisc()

No because you may have data you need to drain. If the tty has become
null then the data is dropped anyway, likewise if there is no bound ldisc
to send it to.

> 2. Mark hungup to tty_struct created by tty_openi(), which will be cleaned
>    at the end of tty_open().

You shouldn't be looking at the tty structure, the tty structure is an
object whose lifetime is not aligned to your port. You should be looking
in the tty port structure.

Your port->ops->activate() is called at the point when your port is
activated, and you have other port methods to handle the other cases if
you need to synchronize with them.


Powered by blists - more mailing lists