[PATCH] tty: tty_port: restore TTY_IO_ERROR on activation failure

[PATCH] tty: tty_port: restore TTY_IO_ERROR on activation failure

[Johan Hovold]

Make sure to restore the TTY_IO_ERROR flag if activation fails to
prevent I/O attempts on a port that is gone or powered down.

This specifically avoids issues like kernel panic due to unclocked
accesses or NULL-pointer dereferences when accessing powered down or
deregistered ports when a TTY ioctl races with hangup and open.

Note that the flag is set again in tty_port_close() but not restoring it
on activation failure leaves a window where drivers fail to handle the
ioctl-hangup race.

Fixes: a9a37ec33a1b ("tty: tty_port: Move the IO_ERROR clear")
Cc: stable@vger.kernel.org	# 2.6.33
Signed-off-by: Johan Hovold <johan@kernel.org>
---
 drivers/tty/tty_port.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/tty/tty_port.c b/drivers/tty/tty_port.c
index 54359310e293..ae33987207b6 100644
--- a/drivers/tty/tty_port.c
+++ b/drivers/tty/tty_port.c
@@ -767,8 +767,10 @@ int tty_port_open(struct tty_port *port, struct tty_struct *tty,
 		clear_bit(TTY_IO_ERROR, &tty->flags);
 		if (port->ops->activate) {
 			int retval = port->ops->activate(port, tty);
-			if (retval)
+			if (retval) {
+				set_bit(TTY_IO_ERROR, &tty->flags);
 				return retval;
+			}
 		}
 		tty_port_set_initialized(port, true);
 	}
-- 
2.55.0

Re: [PATCH] tty: tty_port: restore TTY_IO_ERROR on activation failure

[sashiko-bot]

> Make sure to restore the TTY_IO_ERROR flag if activation fails to
> prevent I/O attempts on a port that is gone or powered down.
> 
> This specifically avoids issues like kernel panic due to unclocked
> accesses or NULL-pointer dereferences when accessing powered down or
> deregistered ports when a TTY ioctl races with hangup and open.
> 
> Note that the flag is set again in tty_port_close() but not restoring it
> on activation failure leaves a window where drivers fail to handle the
> ioctl-hangup race.
> 
> Fixes: a9a37ec33a1b ("tty: tty_port: Move the IO_ERROR clear")
> Cc: stable@vger.kernel.org	# 2.6.33
> Signed-off-by: Johan Hovold <johan@kernel.org>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260908084000.218528-1-johan@kernel.org?part=1