linux-stable.git/drivers/tty/tty_io.c, branch linux-4.15.y

pty: cancel pty slave port buf's work in tty_release

2018-03-24T10:02:49+00:00

[ Upstream commit 2b022ab7542df60021ab57854b3faaaf42552eaf ]

In case that CONFIG_SLUB_DEBUG is on and pty is used, races between
release_one_tty and flush_to_ldisc work threads may happen and lead
to use-after-free condition on tty->link->port. Because SLUB_DEBUG
is turned on, freed tty->link->port is filled with POISON_FREE value.
So far without SLUB_DEBUG, port was filled with zero and flush_to_ldisc
could return without a problem by checking if tty is NULL.

CPU 0                                 CPU 1
-----                                 -----
release_tty                           pty_write
   cancel_work_sync(tty)                 to = tty->link
   tty_kref_put(tty->link)               tty_schedule_flip(to->port)
      << workqueue >>                 ...
      release_one_tty                 ...
         pty_cleanup                  ...
            kfree(tty->link->port)       << workqueue >>
                                         flush_to_ldisc
                                            tty = READ_ONCE(port->itty)
                                            tty is 0x6b6b6b6b6b6b6b6b
                                            !!PANIC!! access tty->ldisc

 Unable to handle kernel paging request at virtual address 6b6b6b6b6b6b6b93
 pgd = ffffffc0eb1c3000
 [6b6b6b6b6b6b6b93] *pgd=0000000000000000, *pud=0000000000000000
 ------------[ cut here ]------------
 Kernel BUG at ffffff800851154c [verbose debug info unavailable]
 Internal error: Oops - BUG: 96000004 [#1] PREEMPT SMP
 CPU: 3 PID: 265 Comm: kworker/u8:9 Tainted: G        W 3.18.31-g0a58eeb #1
 Hardware name: Qualcomm Technologies, Inc. MSM 8996pro v1.1 + PMI8996 Carbide (DT)
 Workqueue: events_unbound flush_to_ldisc
 task: ffffffc0ed610ec0 ti: ffffffc0ed624000 task.ti: ffffffc0ed624000
 PC is at ldsem_down_read_trylock+0x0/0x4c
 LR is at tty_ldisc_ref+0x24/0x4c
 pc : [] lr : [] pstate: 80400145
 sp : ffffffc0ed627cd0
 x29: ffffffc0ed627cd0 x28: 0000000000000000
 x27: ffffff8009e05000 x26: ffffffc0d382cfa0
 x25: 0000000000000000 x24: ffffff800a012f08
 x23: 0000000000000000 x22: ffffffc0703fbc88
 x21: 6b6b6b6b6b6b6b6b x20: 6b6b6b6b6b6b6b93
 x19: 0000000000000000 x18: 0000000000000001
 x17: 00e80000f80d6f53 x16: 0000000000000001
 x15: 0000007f7d826fff x14: 00000000000000a0
 x13: 0000000000000000 x12: 0000000000000109
 x11: 0000000000000000 x10: 0000000000000000
 x9 : ffffffc0ed624000 x8 : ffffffc0ed611580
 x7 : 0000000000000000 x6 : ffffff800a42e000
 x5 : 00000000000003fc x4 : 0000000003bd1201
 x3 : 0000000000000001 x2 : 0000000000000001
 x1 : ffffff800851004c x0 : 6b6b6b6b6b6b6b93

Signed-off-by: Sahara 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

tty: fix data race between tty_init_dev and flush of buf

2018-02-03T16:58:37+00:00

commit b027e2298bd588d6fa36ed2eda97447fb3eac078 upstream.

There can be a race, if receive_buf call comes before
tty initialization completes in n_tty_open and tty->disc_data
may be NULL.

CPU0					CPU1
----					----
 000|n_tty_receive_buf_common()   	n_tty_open()
-001|n_tty_receive_buf2()		tty_ldisc_open.isra.3()
-002|tty_ldisc_receive_buf(inline)	tty_ldisc_setup()

Using ldisc semaphore lock in tty_init_dev till disc_data
initializes completely.

Signed-off-by: Gaurav Kohli 
Reviewed-by: Alan Cox 
Signed-off-by: Greg Kroah-Hartman

tty: add SPDX identifiers to all remaining files in drivers/tty/

2017-11-08T12:08:12+00:00

It's good to have SPDX identifiers in all files to make it easier to
audit the kernel tree for correct licenses.

Update the drivers/tty files files with the correct SPDX license
identifier based on the license text in the file itself.  The SPDX
identifier is a legally binding shorthand, which can be used instead of
the full boiler plate text.

This work is based on a script and data from Thomas Gleixner, Philippe
Ombredanne, and Kate Stewart.

Cc: Jiri Slaby 
Cc: Benjamin Herrenschmidt 
Cc: Paul Mackerras 
Cc: Michael Ellerman 
Cc: Chris Metcalf 
Cc: Jiri Kosina 
Cc: David Sterba 
Cc: James Hogan 
Cc: Rob Herring 
Cc: Eric Anholt 
Cc: Stefan Wahren 
Cc: Florian Fainelli 
Cc: Ray Jui 
Cc: Scott Branden 
Cc: bcm-kernel-feedback-list@broadcom.com
Cc: "James E.J. Bottomley" 
Cc: Helge Deller 
Cc: Joachim Eastwood 
Cc: Matthias Brugger 
Cc: Masahiro Yamada 
Cc: Tobias Klauser 
Cc: Russell King 
Cc: Vineet Gupta 
Cc: Richard Genoud 
Cc: Alexander Shiyan 
Cc: Baruch Siach 
Cc: "Maciej W. Rozycki" 
Cc: "Uwe Kleine-König" 
Cc: Pat Gefre 
Cc: "Guilherme G. Piccoli" 
Cc: Jason Wessel 
Cc: Vladimir Zapolskiy 
Cc: Sylvain Lemieux 
Cc: Carlo Caione 
Cc: Kevin Hilman 
Cc: Liviu Dudau 
Cc: Sudeep Holla 
Cc: Lorenzo Pieralisi 
Cc: Andy Gross 
Cc: David Brown 
Cc: "Andreas Färber" 
Cc: Kevin Cernekee 
Cc: Laxman Dewangan 
Cc: Thierry Reding 
Cc: Jonathan Hunter 
Cc: Barry Song 
Cc: Patrice Chotard 
Cc: Maxime Coquelin 
Cc: Alexandre Torgue 
Cc: "David S. Miller" 
Cc: Peter Korsgaard 
Cc: Timur Tabi 
Cc: Tony Prisk 
Cc: Michal Simek 
Cc: "Sören Brinkmann" 
Cc: Thomas Gleixner 
Cc: Kate Stewart 
Cc: Philippe Ombredanne 
Cc: Jiri Slaby 
Signed-off-by: Greg Kroah-Hartman

Merge tag 'staging-4.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging

2017-09-05T17:36:26+00:00

Pull staging/IIO driver updates from Greg KH:
 "Here is the big staging and IIO driver update for 4.14-rc1.

  Lots of staging driver fixes and cleanups, including some reorginizing
  of the lustre header files to try to impose some sanity on what is,
  and what is not, the uapi for that filesystem.

  There are some tty core changes in here as well, as the speakup
  drivers need them, and that's ok with me, they are sane and the
  speakup code is getting nicer because of it.

  There is also the addition of the obiligatory new wifi driver, just
  because it has been a release or two since we added our last one...

  Other than that, lots and lots of small coding style fixes, as usual.

  All of these have been in linux-next for a while with no reported
  issues"

* tag 'staging-4.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (612 commits)
  staging:rtl8188eu:core Fix remove unneccessary else block
  staging: typec: fusb302: make structure fusb302_psy_desc static
  staging: unisys: visorbus: make two functions static
  staging: fsl-dpaa2/eth: fix off-by-one FD ctrl bitmaks
  staging: r8822be: Simplify deinit_priv()
  staging: r8822be: Remove some dead code
  staging: vboxvideo: Use CONFIG_DRM_KMS_FB_HELPER to check for fbdefio availability
  staging:rtl8188eu Fix comparison to NULL
  staging: rts5208: rename mmc_ddr_tunning_rx_cmd to mmc_ddr_tuning_rx_cmd
  Staging: Pi433: style fix - tabs and spaces
  staging: pi433: fix spelling mistake: "preample" -> "preamble"
  staging:rtl8188eu:core Fix Code Indent
  staging: typec: fusb302: Export current-limit through a power_supply class dev
  staging: typec: fusb302: Add support for USB2 charger detection through extcon
  staging: typec: fusb302: Use client->irq as irq if set
  staging: typec: fusb302: Get max snk mv/ma/mw from device-properties
  staging: typec: fusb302: Set max supply voltage to 5V
  staging: typec: tcpm: Add get_current_limit tcpc_dev callback
  staging:rtl8188eu Use __func__ instead of function name
  staging: lustre: coding style fixes found by checkpatch.pl
  ...

Merge tag 'tty-4.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

2017-09-05T17:30:48+00:00

Pull tty/serial updates from Greg KH:
 "Here is the big tty/serial driver update for 4.14-rc1.

  Well, not all that big, just a number of small serial driver fixes,
  and a new serial driver. Also in here are some much needed goldfish
  tty driver (emulator) fixes to try to get that codebase under control.

  All of these have been in linux-next for a while with no reported
  issues"

* tag 'tty-4.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (94 commits)
  tty: goldfish: Implement support for kernel 'earlycon' parameter
  tty: goldfish: Use streaming DMA for r/w operations on Ranchu platforms
  tty: goldfish: Refactor constants to better reflect their nature
  serial: 8250_port: Remove useless NULL checks
  earlycon: initialise baud field of earlycon device structure
  tty: hvcs: make ktermios const
  pty: show associative slave of ptmx in fdinfo
  tty: n_gsm: Add compat_ioctl
  tty: hvcs: constify vio_device_id
  tty: hvc_vio: constify vio_device_id
  tty: mips_ejtag_fdc: constify mips_cdmm_device_id
  Introduce 8250_men_mcb
  mcb: introduce mcb_get_resource()
  serial: imx: Avoid post-PIO cleanup if TX DMA is started
  tty: serial: imx: disable irq after suspend
  serial: 8250_uniphier: add suspend/resume support
  serial: 8250_uniphier: use CHAR register for canary to detect power-off
  serial: 8250_uniphier: fix serial port index in private data
  serial: 8250: of: Add new port type for MediaTek BTIF controller on MT7622/23 SoC
  dt-bindings: serial: 8250: Add MediaTek BTIF controller bindings
  ...

pty: show associative slave of ptmx in fdinfo

2017-08-28T18:51:23+00:00

This patch adds "tty-index" field to /proc/PID/fdinfo/N if N
specifies /dev/ptmx. The field shows the index of associative
slave pts.

Though a minor number is given for each pts instance, ptmx is not.
It means there is no way in user-space to know the association between
file descriptors for pts/n and ptmx. (n = 0, 1, ...)

This is different from pipe. About pipe such association can be solved
by inode of pipefs.

Providing the way to know the association between pts/n and ptmx helps
users understand the status of running system. lsof can utilize this field.

Signed-off-by: Masatake YAMATO 
Signed-off-by: Greg Kroah-Hartman

tty: undo export of tty_open_by_driver

2017-08-28T14:15:42+00:00

Since we have tty_kopen, we no longer need to export tty_open_by_driver.
This patch makes this function static.

Signed-off-by: Okash Khawaja 
Signed-off-by: Greg Kroah-Hartman

tty: resolve tty contention between kernel and user space

2017-08-28T14:15:41+00:00

The commit 12e84c71b7d4 ("tty: export tty_open_by_driver") exports
tty_open_by_device to allow tty to be opened from inside kernel which
works fine except that it doesn't handle contention with user space or
another kernel-space open of the same tty. For example, opening a tty
from user space while it is kernel opened results in failure and a
kernel log message about mismatch between tty->count and tty's file
open count.

This patch makes kernel access to tty exclusive, so that if a user
process or kernel opens a kernel opened tty, it gets -EBUSY. It does
this by adding TTY_KOPENED flag to tty->flags. When this flag is set,
tty_open_by_driver returns -EBUSY. Instead of overloading
tty_open_by_driver for both kernel and user space, this
patch creates a separate function tty_kopen which closely follows
tty_open_by_driver. tty_kclose closes the tty opened by tty_kopen.

To address the mismatch between tty->count and #fd's, this patch adds
#kopen's to the count before comparing it with tty->count. That way
check_tty_count reflects correct usage count.

Returning -EBUSY on tty open is a change in the interface. I have
tested this with minicom, picocom and commands like "echo foo >
/dev/ttyS0". They all correctly report "Device or resource busy" when
the tty is already kernel opened.

Signed-off-by: Okash Khawaja 
Signed-off-by: Greg Kroah-Hartman

pty: Repair TIOCGPTPEER

2017-08-24T20:23:03+00:00

The implementation of TIOCGPTPEER has two issues.

When /dev/ptmx (as opposed to /dev/pts/ptmx) is opened the wrong
vfsmount is passed to dentry_open.  Which results in the kernel displaying
the wrong pathname for the peer.

The second is simply by caching the vfsmount and dentry of the peer it leaves
them open, in a way they were not previously Which because of the inreased
reference counts can cause unnecessary behaviour differences resulting in
regressions.

To fix these move the ioctl into tty_io.c at a generic level allowing
the ioctl to have access to the struct file on which the ioctl is
being called.  This allows the path of the slave to be derived when
opening the slave through TIOCGPTPEER instead of requiring the path to
the slave be cached.  Thus removing the need for caching the path.

A new function devpts_ptmx_path is factored out of devpts_acquire and
used to implement a function devpts_mntget.   The new function devpts_mntget
takes a filp to perform the lookup on and fsi so that it can confirm
that the superblock that is found by devpts_ptmx_path is the proper superblock.

v2: Lots of fixes to make the code actually work
v3: Suggestions by Linus
    - Removed the unnecessary initialization of filp in ptm_open_peer
    - Simplified devpts_ptmx_path as gotos are no longer required

[ This is the fix for the issue that was reverted in commit
  143c97cc6529, but this time without breaking 'pbuilder' due to
  increased reference counts   - Linus ]

Fixes: 54ebbfb16034 ("tty: add TIOCGPTPEER ioctl")
Reported-by: Christian Brauner 
Reported-and-tested-by: Stefan Lippers-Hollmann 
Signed-off-by: "Eric W. Biederman" 
Signed-off-by: Linus Torvalds

tty: add function to convert device name to number

2017-06-27T07:08:47+00:00

The function converts strings like ttyS0 and ttyUSB0 to dev_t like
(4, 64) and (188, 0). It does this by scanning tty_drivers list for
corresponding device name and index. If the driver is not registered,
this function returns -ENODEV. It also acquires tty_mutex.

Signed-off-by: Okash Khawaja 
Signed-off-by: Greg Kroah-Hartman