From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932570AbdJYCQv (ORCPT ); Tue, 24 Oct 2017 22:16:51 -0400 Received: from szxga06-in.huawei.com ([45.249.212.32]:35303 "EHLO huawei.com" rhost-flags-OK-FAIL-OK-FAIL) by vger.kernel.org with ESMTP id S932549AbdJYCQn (ORCPT ); Tue, 24 Oct 2017 22:16:43 -0400 From: taoyuhong To: , CC: , Subject: [PATCH] tty: fix flush_to_ldisc() oops before tty_open is done Date: Wed, 25 Oct 2017 10:15:35 +0800 Message-ID: <1508897735-30968-1-git-send-email-taoyuhong@huawei.com> X-Mailer: git-send-email 1.9.5.msysgit.0 MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [10.177.235.143] X-CFilter-Loop: Reflected Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Yuhong Tao When tty_open() is opening a serial tty at the first time, after alloc_tty_struct() is called, before tty->ops->open() is finished. Serial driever like pl011 on ARM is ready to setup kworker threads to receive data with flush_to_ldisc(). Serial input at this time window can trigger kernel oops. On the other side, flush_to_ldisc() can also oops on a hung-up tty. It is unknown why flush_to_ldisc() can happen after target tty is hung up. But both of these 2 situations come into a same result, look like that: [ 11.287911] [] n_tty_receive_buf_common+0x58/0xa58 [ 11.290161] [] n_tty_receive_buf2+0x10/0x18 [ 11.292162] [] tty_ldisc_receive_buf+0x20/0x68 [ 11.294318] [] flush_to_ldisc+0xd4/0xe8 [ 11.296181] [] process_one_work+0x128/0x2f0 [ 11.298166] [] worker_thread+0x54/0x440 [ 11.300006] [] kthread+0xe4/0xf8 [ 11.301642] [] ret_from_fork+0x10/0x50 [ 11.303460] Code: b9009fbf f90047a0 d2844c00 8b170000 (c8dffc03) Calltrace may have a bit different behind n_tty_receive_buf_common, that is about accessing to uninitialized or realeased data struct. Serial driver may has problem, but tty driver can easily handle these 2 oops problems by: 1. Skip data transfer of hung-up tty, in flush_to_ldisc() 2. Mark hungup to tty_struct created by tty_openi(), which will be cleaned at the end of tty_open(). This is tested with linux-4.13.9/Debian on ARM virtual machine, whose serial chip is pl011. You have a little chance to watch this happen, when keep input from keyboard during system start or shutdown. And it happens 100% if a msleep() is inserted before tty->ops->open() is called in tty_open(), after tty_struct is created by tty_init_dev(). Signed-off-by: Yuhong Tao --- drivers/tty/pty.c | 1 + drivers/tty/tty_io.c | 3 +++ drivers/tty/tty_port.c | 5 +++++ 3 files changed, 9 insertions(+) diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c index a6d5164..ad5b075 100644 --- a/drivers/tty/pty.c +++ b/drivers/tty/pty.c @@ -853,6 +853,7 @@ static int ptmx_open(struct inode *inode, struct file *filp) tty_debug_hangup(tty, "opening (count=%d)\n", tty->count); + clear_bit(TTY_HUPPED, &tty->flags); tty_unlock(tty); return 0; err_release: diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c index 10c4038..f3abad0 100644 --- a/drivers/tty/tty_io.c +++ b/drivers/tty/tty_io.c @@ -1313,6 +1313,9 @@ struct tty_struct *tty_init_dev(struct tty_driver *driver, int idx) tty->port->itty = tty; + set_bit(TTY_HUPPED, &tty->flags); + barrier(); + /* * Structures all installed ... call the ldisc open routines. * If we fail here just call release_tty to clean up. No need diff --git a/drivers/tty/tty_port.c b/drivers/tty/tty_port.c index 6b13719..e43482f 100644 --- a/drivers/tty/tty_port.c +++ b/drivers/tty/tty_port.c @@ -34,6 +34,11 @@ static int tty_port_default_receive_buf(struct tty_port *port, if (!disc) return 0; + if (test_bit(TTY_HUPPED, &tty->flags)) { + tty_ldisc_deref(disc); + return 0; + } + ret = tty_ldisc_receive_buf(disc, p, (char *)f, count); tty_ldisc_deref(disc); -- 1.8.3.1