| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2025022013-create-enamel-02c8@gregkh>
Date: Thu, 20 Feb 2025 06:15:44 +0100
From: Greg KH <gregkh@...uxfoundation.org>
To: Suraj Patil <surajpatil522@...il.com>
Cc: linux-kernel@...r.kernel.org, jirislaby@...nel.org
Subject: Re: [PATCH] tty: ipwireless: Fix locking in ioctl and write_room
functions
On Wed, Feb 19, 2025 at 07:24:26PM +0000, Suraj Patil wrote:
> - Add mutex locks around tty->ipw_tty_mutex in ioctl, tiocmget, and write_room.
> - Resolve FIXME comments related to locking ambiguity.
>
> Signed-off-by: Suraj Patil <surajpatil522@...il.com>
> ---
> drivers/tty/ipwireless/tty.c | 178 ++++++++++++++++++++---------------
> 1 file changed, 100 insertions(+), 78 deletions(-)
>
> diff --git a/drivers/tty/ipwireless/tty.c b/drivers/tty/ipwireless/tty.c
> index b6de40815fb9..c4befc3d09f9 100644
> --- a/drivers/tty/ipwireless/tty.c
> +++ b/drivers/tty/ipwireless/tty.c
> @@ -229,21 +229,21 @@ static ssize_t ipw_write(struct tty_struct *linux_tty, const u8 *buf,
>
> static unsigned int ipw_write_room(struct tty_struct *linux_tty)
> {
> - struct ipw_tty *tty = linux_tty->driver_data;
> - int room;
> + struct ipw_tty *tty = linux_tty->driver_data;
> + int room = 0;
>
> - /* FIXME: Exactly how is the tty object locked here .. */
> - if (!tty)
> - return 0;
> + if (!tty)
> + return 0;
>
> - if (!tty->port.count)
> - return 0;
> -
> - room = IPWIRELESS_TX_QUEUE_SIZE - tty->tx_bytes_queued;
> - if (room < 0)
> - room = 0;
> + mutex_lock(&tty->ipw_tty_mutex); // Lock added
> + if (!tty->port.count) {
> + mutex_unlock(&tty->ipw_tty_mutex);
> + return 0;
> + }
>
> - return room;
> + room = IPWIRELESS_TX_QUEUE_SIZE - tty->tx_bytes_queued;
> + mutex_unlock(&tty->ipw_tty_mutex); // Unlock added
> + return room < 0 ? 0 : room;
> }
>
> static int ipwireless_get_serial_info(struct tty_struct *linux_tty,
> @@ -351,85 +351,107 @@ static int set_control_lines(struct ipw_tty *tty, unsigned int set,
>
> static int ipw_tiocmget(struct tty_struct *linux_tty)
> {
> - struct ipw_tty *tty = linux_tty->driver_data;
> - /* FIXME: Exactly how is the tty object locked here .. */
> + struct ipw_tty *tty = linux_tty->driver_data;
> + int ret;
>
> - if (!tty)
> - return -ENODEV;
> + if (!tty)
> + return -ENODEV;
>
> - if (!tty->port.count)
> - return -EINVAL;
> + mutex_lock(&tty->ipw_tty_mutex); // Lock added
> + if (!tty->port.count) {
> + mutex_unlock(&tty->ipw_tty_mutex);
> + return -EINVAL;
> + }
>
> - return get_control_lines(tty);
> + ret = get_control_lines(tty);
> + mutex_unlock(&tty->ipw_tty_mutex); // Unlock added
> + return ret;
> }
>
> -static int
> -ipw_tiocmset(struct tty_struct *linux_tty,
> - unsigned int set, unsigned int clear)
> +static int ipw_tiocmset(struct tty_struct *linux_tty,
> + unsigned int set, unsigned int clear)
> {
> - struct ipw_tty *tty = linux_tty->driver_data;
> - /* FIXME: Exactly how is the tty object locked here .. */
> + struct ipw_tty *tty = linux_tty->driver_data;
> + int ret;
>
> - if (!tty)
> - return -ENODEV;
> + if (!tty)
> + return -ENODEV;
>
> - if (!tty->port.count)
> - return -EINVAL;
> + mutex_lock(&tty->ipw_tty_mutex); // Lock added
> + if (!tty->port.count) {
> + mutex_unlock(&tty->ipw_tty_mutex);
> + return -EINVAL;
> + }
>
> - return set_control_lines(tty, set, clear);
> + ret = set_control_lines(tty, set, clear);
> + mutex_unlock(&tty->ipw_tty_mutex); // Unlock added
> + return ret;
> }
>
> static int ipw_ioctl(struct tty_struct *linux_tty,
> - unsigned int cmd, unsigned long arg)
> + unsigned int cmd, unsigned long arg)
> {
> - struct ipw_tty *tty = linux_tty->driver_data;
> -
> - if (!tty)
> - return -ENODEV;
> -
> - if (!tty->port.count)
> - return -EINVAL;
> -
> - /* FIXME: Exactly how is the tty object locked here .. */
> - if (tty->tty_type == TTYTYPE_MODEM) {
> - switch (cmd) {
> - case PPPIOCGCHAN:
> - {
> - int chan = ipwireless_ppp_channel_index(
> - tty->network);
> -
> - if (chan < 0)
> - return -ENODEV;
> - if (put_user(chan, (int __user *) arg))
> - return -EFAULT;
> - }
> - return 0;
> -
> - case PPPIOCGUNIT:
> - {
> - int unit = ipwireless_ppp_unit_number(
> - tty->network);
> -
> - if (unit < 0)
> - return -ENODEV;
> - if (put_user(unit, (int __user *) arg))
> - return -EFAULT;
> - }
> - return 0;
> -
> - case FIONREAD:
> - {
> - int val = 0;
> -
> - if (put_user(val, (int __user *) arg))
> - return -EFAULT;
> - }
> - return 0;
> - case TCFLSH:
> - return tty_perform_flush(linux_tty, arg);
> - }
> - }
> - return -ENOIOCTLCMD;
> + struct ipw_tty *tty = linux_tty->driver_data;
> + int ret = -ENOIOCTLCMD; // Default return value
> +
> + if (!tty)
> + return -ENODEV;
> +
> + if (!tty->port.count)
> + return -EINVAL;
> +
> + // Acquire the mutex to lock the tty object
> + mutex_lock(&tty->ipw_tty_mutex);
> +
> + if (tty->tty_type == TTYTYPE_MODEM) {
> + switch (cmd) {
> + case PPPIOCGCHAN: {
> + int chan = ipwireless_ppp_channel_index(tty->network);
> +
> + if (chan < 0) {
> + ret = -ENODEV;
> + break;
> + }
> + if (put_user(chan, (int __user *) arg)) {
> + ret = -EFAULT;
> + break;
> + }
> + ret = 0;
> + break;
> + }
> + case PPPIOCGUNIT: {
> + int unit = ipwireless_ppp_unit_number(tty->network);
> +
> + if (unit < 0) {
> + ret = -ENODEV;
> + break;
> + }
> + if (put_user(unit, (int __user *) arg)) {
> + ret = -EFAULT;
> + break;
> + }
> + ret = 0;
> + break;
> + }
> + case FIONREAD: {
> + int val = 0;
> +
> + if (put_user(val, (int __user *) arg)) {
> + ret = -EFAULT;
> + break;
> + }
> + ret = 0;
> + break;
> + }
> + case TCFLSH:
> + ret = tty_perform_flush(linux_tty, arg);
> + break;
> + }
> + }
> +
> + // Release the mutex before returning
> + mutex_unlock(&tty->ipw_tty_mutex);
> + return ret;
> }
>
> static int add_tty(int j,
> --
> 2.43.0
>
Hi,
This is the friendly patch-bot of Greg Kroah-Hartman. You have sent him
a patch that has triggered this response. He used to manually respond
to these common problems, but in order to save his sanity (he kept
writing the same thing over and over, yet to different people), I was
created. Hopefully you will not take offence and will fix the problem
in your patch and resubmit it so that it can be accepted into the Linux
kernel tree.
You are receiving this message because of the following common error(s)
as indicated below:
- Your patch contains warnings and/or errors noticed by the
scripts/checkpatch.pl tool.
- Your patch did many different things all at once, making it difficult
to review. All Linux kernel patches need to only do one thing at a
time. If you need to do multiple things (such as clean up all coding
style issues in a file/driver), do it in a sequence of patches, each
one doing only one thing. This will make it easier to review the
patches to ensure that they are correct, and to help alleviate any
merge issues that larger patches can cause.
If you wish to discuss this problem further, or you have questions about
how to resolve this issue, please feel free to respond to this email and
Greg will reply once he has dug out from the pending patches received
from other developers.
thanks,
greg k-h's patch email bot
Powered by blists - more mailing lists