From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.0 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, MENTIONS_GIT_HOSTING,SIGNED_OFF_BY,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 086AAC43381 for ; Thu, 28 Mar 2019 06:33:52 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id C02B1217D7 for ; Thu, 28 Mar 2019 06:33:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1553754831; bh=6aus7Y+fvG6H5TmTWFTpKMODeZRO8XvhaAZEmx8H1lU=; h=Subject:To:From:Date:List-ID:From; b=gTNh8YonDK3ipyBz2EIXCb1qrDMWvNvUv0twedwT3P1AjI4wpJp7fY3To4qyJsF+j 78guvZdXcF1C3T/4yu+HEeOwUbEmivlReqgsEJC4x+AMTAF2uoYDPX/DePLqwKirJT OQ2O1Xt41U3csaK/etqsdMSEjQ09K3nOThv/txh0= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1725806AbfC1Gdv (ORCPT ); Thu, 28 Mar 2019 02:33:51 -0400 Received: from mail.kernel.org ([198.145.29.99]:37948 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726172AbfC1Gdu (ORCPT ); Thu, 28 Mar 2019 02:33:50 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 0EC7D20811; Thu, 28 Mar 2019 06:33:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1553754830; bh=6aus7Y+fvG6H5TmTWFTpKMODeZRO8XvhaAZEmx8H1lU=; h=Subject:To:From:Date:From; b=jWQ0t0SmwJTVJcnAwxK3xaNO89vqV7JododYz2mfrLRoC9x+euI5VoInnHfeip2aZ 1cYHiudD+18aylbTafZEto2gP2K+HZRuNbyA1aHmbmJTDNdUMfCywzedoOh+M8evc3 kAieXghC9FxiLMxhV/ygHkD06s176xq3FLrsf+sI= Subject: patch "tty: pty: Fix race condition between release_one_tty and pty_write" added to tty-next To: keun-o.park@darkmatter.ae, gregkh@linuxfoundation.org, stable@vger.kernel.org From: Date: Thu, 28 Mar 2019 07:32:35 +0100 Message-ID: <15537547556369@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org This is a note to let you know that I've just added the patch titled tty: pty: Fix race condition between release_one_tty and pty_write to my tty git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git in the tty-next branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will also be merged in the next major kernel release during the merge window. If you have any questions about this process, please let me know. >From b9ca5f8560af244489b4a1bc1ae88b341f24bc95 Mon Sep 17 00:00:00 2001 From: Sahara Date: Mon, 11 Feb 2019 11:09:15 +0400 Subject: tty: pty: Fix race condition between release_one_tty and pty_write Especially when a linked tty is used such as pty, the linked tty port's buf works have not been cancelled while master tty port's buf work has been cancelled. Since release_one_tty and flush_to_ldisc run in workqueue threads separately, when pty_cleanup happens and link tty port is freed, flush_to_ldisc tries to access freed port and port->itty, eventually it causes a panic. This patch utilizes the magic value with holding the tty_mutex to check if the tty->link is valid. Fixes: 2b022ab7542d ("pty: cancel pty slave port buf's work in tty_release") Signed-off-by: Sahara Cc: stable Signed-off-by: Greg Kroah-Hartman --- drivers/tty/pty.c | 7 +++++++ drivers/tty/tty_io.c | 3 +++ 2 files changed, 10 insertions(+) diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c index 00099a8439d2..ef72031ab5b9 100644 --- a/drivers/tty/pty.c +++ b/drivers/tty/pty.c @@ -116,6 +116,12 @@ static int pty_write(struct tty_struct *tty, const unsigned char *buf, int c) if (tty->stopped) return 0; + mutex_lock(&tty_mutex); + if (to->magic != TTY_MAGIC) { + mutex_unlock(&tty_mutex); + return -EIO; + } + if (c > 0) { spin_lock_irqsave(&to->port->lock, flags); /* Stuff the data into the input queue of the other end */ @@ -125,6 +131,7 @@ static int pty_write(struct tty_struct *tty, const unsigned char *buf, int c) tty_flip_buffer_push(to->port); spin_unlock_irqrestore(&to->port->lock, flags); } + mutex_unlock(&tty_mutex); return c; } diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c index 5fa250157025..c27777f3b8c4 100644 --- a/drivers/tty/tty_io.c +++ b/drivers/tty/tty_io.c @@ -1448,10 +1448,13 @@ static void release_one_tty(struct work_struct *work) struct tty_driver *driver = tty->driver; struct module *owner = driver->owner; + mutex_lock(&tty_mutex); if (tty->ops->cleanup) tty->ops->cleanup(tty); tty->magic = 0; + mutex_unlock(&tty_mutex); + tty_driver_kref_put(driver); module_put(owner); -- 2.21.0