Re: hvc_console: Don't access hvc_task if not initialised

Milton Miller
2011-03-24T14:58:17Z

[removed stable list from discussion]

On Thu, 24 Mar 2011 07:29:58 -0000, Amit Shah wrote:
> hvc_open() can be called without having any backing device. This
> results in a call to hvc_kick() which calls wake_up_process on a NULL
> pointer.

How is hvc_open called without a hvc_driver registered to the tty layer?

> Ensure hvc is initialised by checking for a non-NULL hvc_task
> before waking up the hvc thread.

No if the task is missing the subsystem is really stuck. Put a check
in open and refuse to open.

>
> This was found by an autotest run for virtio_console without having a
> console backend.
>

stack trace please

> CC: stable@kernel.org
> Signed-off-by: Amit Shah <amit.shah@redhat.com>
>
> ---
> drivers/tty/hvc/hvc_console.c | 3 +++
> 1 files changed, 3 insertions(+), 0 deletions(-)
>
> diff --git a/drivers/tty/hvc/hvc_console.c b/drivers/tty/hvc/hvc_console.c
> index e9cba13..b2cb5cc 100644
> --- a/drivers/tty/hvc/hvc_console.c
> +++ b/drivers/tty/hvc/hvc_console.c
> @@ -286,6 +286,9 @@ EXPORT_SYMBOL_GPL(hvc_instantiate);
> /* Wake the sleeping khvcd */
> void hvc_kick(void)
> {
> + if (!hvc_task)
> + return;
> +
> hvc_kicked = 1;
> wake_up_process(hvc_task);
> }