From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Roman Rakus <rrakus@redhat.com>,
Lingzhu Xiang <lxiang@redhat.com>,
Oleg Nesterov <oleg@redhat.com>, Jiri Slaby <jslaby@suse.cz>
Subject: [ 17/58] tty: set_termios/set_termiox should not return -EINTR
Date: Mon, 25 Feb 2013 14:19:13 -0800 [thread overview]
Message-ID: <20130225221639.701366903@linuxfoundation.org> (raw)
In-Reply-To: <20130225221636.018756060@linuxfoundation.org>
3.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Nesterov <oleg@redhat.com>
commit 183d95cdd834381c594d3aa801c1f9f9c0c54fa9 upstream.
See https://bugzilla.redhat.com/show_bug.cgi?id=904907
read command causes bash to abort with double free or corruption (out).
A simple test-case from Roman:
// Compile the reproducer and send sigchld ti that process.
// EINTR occurs even if SA_RESTART flag is set.
void handler(int sig)
{
}
main()
{
struct sigaction act;
act.sa_handler = handler;
act.sa_flags = SA_RESTART;
sigaction (SIGCHLD, &act, 0);
struct termio ttp;
ioctl(0, TCGETA, &ttp);
while(1)
{
if (ioctl(0, TCSETAW, ttp) < 0)
{
if (errno == EINTR)
{
fprintf(stderr, "BUG!"); return(1);
}
}
}
}
Change set_termios/set_termiox to return -ERESTARTSYS to fix this
particular problem.
I didn't dare to change other EINTR's in drivers/tty/, but they look
equally wrong.
Reported-by: Roman Rakus <rrakus@redhat.com>
Reported-by: Lingzhu Xiang <lxiang@redhat.com>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Cc: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/tty_ioctl.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/tty/tty_ioctl.c
+++ b/drivers/tty/tty_ioctl.c
@@ -617,7 +617,7 @@ static int set_termios(struct tty_struct
if (opt & TERMIOS_WAIT) {
tty_wait_until_sent(tty, 0);
if (signal_pending(current))
- return -EINTR;
+ return -ERESTARTSYS;
}
tty_set_termios(tty, &tmp_termios);
@@ -684,7 +684,7 @@ static int set_termiox(struct tty_struct
if (opt & TERMIOS_WAIT) {
tty_wait_until_sent(tty, 0);
if (signal_pending(current))
- return -EINTR;
+ return -ERESTARTSYS;
}
mutex_lock(&tty->termios_mutex);
next prev parent reply other threads:[~2013-02-25 22:19 UTC|newest]
Thread overview: 65+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-02-25 22:18 [ 00/58] 3.7.10-stable review Greg Kroah-Hartman
2013-02-25 22:18 ` [ 01/58] drm/nouveau/vm: fix memory corruption when pgt allocation fails Greg Kroah-Hartman
2013-02-25 22:18 ` [ 02/58] x86-32, mm: Rip out x86_32 NUMA remapping code Greg Kroah-Hartman
2013-02-25 22:18 ` [ 03/58] x86-32, mm: Remove reference to resume_map_numa_kva() Greg Kroah-Hartman
2013-02-25 22:19 ` [ 04/58] x86-32, mm: Remove reference to alloc_remap() Greg Kroah-Hartman
2013-02-25 22:19 ` [ 05/58] perf tools: Fix build with bison 2.3 and older Greg Kroah-Hartman
2013-02-25 22:19 ` [ 06/58] perf hists: Fix period symbol_conf.field_sep display Greg Kroah-Hartman
2013-02-25 22:19 ` [ 07/58] mm: fix pageblock bitmap allocation Greg Kroah-Hartman
2013-02-25 22:19 ` [ 08/58] timeconst.pl: Eliminate Perl warning Greg Kroah-Hartman
2013-02-25 22:19 ` [ 09/58] genirq: Avoid deadlock in spurious handling Greg Kroah-Hartman
2013-02-25 22:19 ` [ 10/58] posix-cpu-timers: Fix nanosleep task_struct leak Greg Kroah-Hartman
2013-02-25 22:19 ` [ 11/58] hrtimer: Prevent hrtimer_enqueue_reprogram race Greg Kroah-Hartman
2013-02-25 22:19 ` [ 12/58] x86: Hyper-V: register clocksource only if its advertised Greg Kroah-Hartman
2013-02-25 22:19 ` [ 13/58] workqueue: un-GPL function delayed_work_timer_fn() Greg Kroah-Hartman
2013-02-25 22:19 ` [ 14/58] ALSA: ali5451: remove irq enabling in pointer callback Greg Kroah-Hartman
2013-02-25 22:19 ` [ 15/58] ALSA: rme32.c irq enabling after spin_lock_irq Greg Kroah-Hartman
2013-02-25 22:19 ` [ 16/58] tty: Prevent deadlock in n_gsm driver Greg Kroah-Hartman
2013-02-25 22:19 ` Greg Kroah-Hartman [this message]
2013-02-25 22:19 ` [ 18/58] USB: serial: fix null-pointer dereferences on disconnect Greg Kroah-Hartman
2013-02-25 22:19 ` [ 19/58] serial: imx: Fix recursive locking bug Greg Kroah-Hartman
2013-02-25 22:19 ` [ 20/58] serial_core: Fix type definition for PORT_BRCM_TRUMANAGE Greg Kroah-Hartman
2013-02-25 22:19 ` [ 21/58] b43: Increase number of RX DMA slots Greg Kroah-Hartman
2013-02-25 22:19 ` [ 22/58] rtlwifi: rtl8192cu: Add new USB ID Greg Kroah-Hartman
2013-02-25 22:19 ` [ 23/58] rtlwifi: usb: allocate URB control message setup_packet and data buffer separately Greg Kroah-Hartman
2013-02-25 22:19 ` [ 24/58] tty vt: fix character insertion overflow Greg Kroah-Hartman
2013-02-25 22:19 ` [ 25/58] xen: Send spinlock IPI to all waiters Greg Kroah-Hartman
2013-02-25 22:19 ` [ 26/58] xen: close evtchn port if binding to irq fails Greg Kroah-Hartman
2013-02-25 22:19 ` [ 27/58] zram: Fix deadlock bug in partial read/write Greg Kroah-Hartman
2013-02-25 22:19 ` [ 28/58] Driver core: treat unregistered bus_types as having no devices Greg Kroah-Hartman
2013-02-25 22:19 ` [ 29/58] mmu_notifier_unregister NULL Pointer deref and multiple ->release() callouts Greg Kroah-Hartman
2013-02-25 22:19 ` [ 30/58] KVM: s390: Handle hosts not supporting s390-virtio Greg Kroah-Hartman
2013-02-25 22:19 ` [ 31/58] s390/kvm: Fix store status for ACRS/FPRS Greg Kroah-Hartman
2013-02-25 22:19 ` [ 32/58] futex: Revert "futex: Mark get_robust_list as deprecated" Greg Kroah-Hartman
2013-02-25 22:19 ` [ 33/58] inotify: remove broken mask checks causing unmount to be EINVAL Greg Kroah-Hartman
2013-02-25 22:19 ` [ 34/58] fs/block_dev.c: page cache wrongly left invalidated after revalidate_disk() Greg Kroah-Hartman
2013-02-25 22:19 ` [ 35/58] ocfs2: unlock super lock if lockres refresh failed Greg Kroah-Hartman
2013-02-25 22:19 ` [ 36/58] drivers/video/backlight/adp88?0_bl.c: fix resume Greg Kroah-Hartman
2013-02-25 22:19 ` [ 37/58] tmpfs: fix use-after-free of mempolicy object Greg Kroah-Hartman
2013-02-25 22:19 ` [ 38/58] mm/fadvise.c: drain all pagevecs if POSIX_FADV_DONTNEED fails to discard all pages Greg Kroah-Hartman
2013-02-25 22:19 ` [ 39/58] xen-pciback: rate limit error messages from xen_pcibk_enable_msi{,x}() Greg Kroah-Hartman
2013-02-25 22:19 ` [ 40/58] drivercore: Fix ordering between deferred_probe and exiting initcalls Greg Kroah-Hartman
2013-02-25 22:19 ` [ 41/58] umount oops when remove blocklayoutdriver first Greg Kroah-Hartman
2013-02-25 22:19 ` [ 42/58] NLM: Ensure that we resend all pending blocking locks after a reclaim Greg Kroah-Hartman
2013-02-25 22:19 ` [ 43/58] NFSv4.1: Dont decode skipped layoutgets Greg Kroah-Hartman
2013-02-25 22:19 ` [ 44/58] p54usb: corrected USB ID for T-Com Sinus 154 data II Greg Kroah-Hartman
2013-02-25 22:19 ` [ 45/58] ALSA: usb-audio: fix Roland A-PRO support Greg Kroah-Hartman
2013-02-25 22:19 ` [ 46/58] ALSA: usb: Fix Processing Unit Descriptor parsers Greg Kroah-Hartman
2013-02-25 22:19 ` [ 47/58] ALSA: hda - Release assigned pin/cvt at error path of hdmi_pcm_open() Greg Kroah-Hartman
2013-02-25 22:19 ` [ 48/58] ALSA: hda - Fix default multichannel HDMI mapping regression Greg Kroah-Hartman
2013-02-25 22:19 ` [ 49/58] ALSA: hda - Workaround for silent output on Sony Vaio VGC-LN51JGB with ALC889 Greg Kroah-Hartman
2013-02-25 22:19 ` [ 50/58] ALSA: hda - hdmi: ELD shouldnt be valid after unplug Greg Kroah-Hartman
2013-02-25 22:19 ` [ 51/58] GFS2: Get a block reservation before resizing a file Greg Kroah-Hartman
2013-02-25 22:34 ` Bob Peterson
2013-02-25 22:19 ` [ 52/58] sunvdc: Fix off-by-one in generic_request() Greg Kroah-Hartman
2013-02-25 22:19 ` [ 53/58] sparc64: Add missing HAVE_ARCH_TRANSPARENT_HUGEPAGE Greg Kroah-Hartman
2013-02-25 22:19 ` [ 54/58] sparc64: Fix get_user_pages_fast() wrt. THP Greg Kroah-Hartman
2013-02-25 22:19 ` [ 55/58] sparc64: Fix gfp_flags setting in tsb_grow() Greg Kroah-Hartman
2013-02-25 22:19 ` [ 56/58] sparc64: Handle hugepage TSB being NULL Greg Kroah-Hartman
2013-02-25 22:19 ` [ 57/58] sparc64: Fix tsb_grow() in atomic context Greg Kroah-Hartman
2013-02-25 22:19 ` [ 58/58] sparc64: Fix huge PMD to PTE translation for sun4u in TLB miss handler Greg Kroah-Hartman
2013-02-26 0:47 ` [ 00/58] 3.7.10-stable review Shuah Khan
2013-02-26 1:02 ` Greg Kroah-Hartman
2013-02-26 17:37 ` Andre Tomt
2013-02-26 17:48 ` Josh Boyer
2013-02-26 17:52 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20130225221639.701366903@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=jslaby@suse.cz \
--cc=linux-kernel@vger.kernel.org \
--cc=lxiang@redhat.com \
--cc=oleg@redhat.com \
--cc=rrakus@redhat.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).