Re: [PATCH v2 2/2] s390/sclp: Implement resize for sclp-vt220 console

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] s390/sclp: lost terminal resize event due to TOCTOU race
--

commit 66ee01928776071bac37719344cd6f2a8ad2ae89
Author: Maximilian Immanuel Brandtner <maxbr@linux.ibm.com>

s390/sclp: Implement resize for sclp-vt220 console

This commit adds support for sclp vt220 resize events to enable
host-initiated terminal resizing when using the sclp-vt220 console. This
allows QEMU to dynamically resize the console.

> diff --git a/drivers/s390/char/sclp_vt220.c b/drivers/s390/char/sclp_vt220.c
> index 7c168a66e4afe..a5a9ac1b1fe07 100644
> --- a/drivers/s390/char/sclp_vt220.c
> +++ b/drivers/s390/char/sclp_vt220.c

[ ... ]

> @@ -552,12 +603,15 @@ static void sclp_vt220_receiver_fn(struct evbuf_header *evbuf)
>  static int
>  sclp_vt220_open(struct tty_struct *tty, struct file *filp)
>  {
> +	struct winsize ws;
> +
>  	if (tty->count == 1) {
> +		spin_lock_irq(&sclp_vt220_lock);
> +		ws = sclp_vt220_winsize;
> +		spin_unlock_irq(&sclp_vt220_lock);
> +
>  		tty_port_tty_set(&sclp_vt220_port, tty);
> -		if (!tty->winsize.ws_row && !tty->winsize.ws_col) {
> -			tty->winsize.ws_row = 24;
> -			tty->winsize.ws_col = 80;
> -		}
> +		tty_do_resize(tty, &ws);

[Severity: Medium]
Could this sequence result in a lost terminal resize event due to a TOCTOU
race?

If a host resize event arrives exactly after sclp_vt220_open() has read the
cached window size into ws, but before it attaches the tty to the port:

sclp_vt220_open()
    ws = sclp_vt220_winsize;
    // Host resize event arrives here, updates sclp_vt220_winsize
    // and schedules sclp_vt220_resize_work

The resize worker could execute immediately:

sclp_vt220_resize()
    tty = tty_port_tty_get(&sclp_vt220_port);
    if (!tty)
        return; // Worker aborts silently because tty is not set yet

Then sclp_vt220_open() continues:

sclp_vt220_open()
    tty_port_tty_set(&sclp_vt220_port, tty);
    tty_do_resize(tty, &ws);

Would this cause the terminal to be unconditionally overwritten with the stale
cached size, permanently desynchronizing it from the emulator's size until
manually resized?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260922095903.1595794-1-maxbr@linux.ibm.com?part=2