linux.git/drivers/tty/hvc, branch v3.5-rc2 Linux kernel source tree tty: hvc_xen: NULL dereference on allocation failure 2012-05-15T15:48:45+00:00 Dan Carpenter dan.carpenter@oracle.com 2012-05-15T08:47:47+00:00 bdb595b4a906b8124d0dc5ff852f84302e2e7955 If kzalloc() returns a NULL here, we pass a NULL to xencons_disconnect_backend() which will cause an Oops. Also I removed the __GFP_ZERO while I was at it since kzalloc() implies __GFP_ZERO. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
If kzalloc() returns a NULL here, we pass a NULL to
xencons_disconnect_backend() which will cause an Oops.

Also I removed the __GFP_ZERO while I was at it since kzalloc() implies
__GFP_ZERO.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
TTY: hvc, fix TTY refcounting 2012-04-13T17:54:43+00:00 Jiri Slaby jslaby@suse.cz 2012-04-13T08:31:32+00:00 a2f892060f174e5f90041167ca00eb9e68badcb8 A -next commit "TTY: HVC, use tty from tty_port" switched the driver to use tty_port helper for tty refcounting. But it omitted to remove manual tty refcounting from open, close and hangup. So now we are getting random crashes caused by use-after-free: Unable to handle kernel paging request for data at address 0xc0000003f9d550 Faulting instruction address: 0xc0000000001b7f40 Oops: Kernel access of bad area, sig: 11 [#1] ... NIP: c0000000001b7f40 LR: c0000000001b7f14 CTR: c0000000000e04f0 ... NIP [c0000000001b7f40] .__kmalloc+0x70/0x230 LR [c0000000001b7f14] .__kmalloc+0x44/0x230 Call Trace: [c0000003f68bf930] [c0000003f68bf9b0] 0xc0000003f68bf9b0 (unreliable) [c0000003f68bf9e0] [c0000000001e5424] .alloc_fdmem+0x24/0x70 [c0000003f68bfa60] [c0000000001e54f8] .alloc_fdtable+0x88/0x130 [c0000003f68bfaf0] [c0000000001e5924] .dup_fd+0x384/0x450 [c0000003f68bfbd0] [c00000000009a310] .copy_process+0x880/0x11d0 [c0000003f68bfcd0] [c00000000009aee0] .do_fork+0x70/0x400 [c0000003f68bfdc0] [c0000000000141c4] .sys_clone+0x54/0x70 [c0000003f68bfe30] [c000000000009aa0] .ppc_clone+0x8/0xc Fix that by complete removal of tty_kref_get/put in open/close/hangup paths. Signed-off-by: Jiri Slaby <jslaby@suse.cz> Reported-and-tested-by: Michael Neuling <mikey@neuling.org> Cc: Stephen Rothwell <sfr@canb.auug.org.au> Cc: ppc-dev <linuxppc-dev@lists.ozlabs.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
A -next commit "TTY: HVC, use tty from tty_port" switched the driver
to use tty_port helper for tty refcounting. But it omitted to remove
manual tty refcounting from open, close and hangup. So now we are
getting random crashes caused by use-after-free:
Unable to handle kernel paging request for data at address 0xc0000003f9d550
Faulting instruction address: 0xc0000000001b7f40
Oops: Kernel access of bad area, sig: 11 [#1]
...
NIP: c0000000001b7f40 LR: c0000000001b7f14 CTR: c0000000000e04f0
...
NIP [c0000000001b7f40] .__kmalloc+0x70/0x230
LR [c0000000001b7f14] .__kmalloc+0x44/0x230
Call Trace:
[c0000003f68bf930] [c0000003f68bf9b0] 0xc0000003f68bf9b0 (unreliable)
[c0000003f68bf9e0] [c0000000001e5424] .alloc_fdmem+0x24/0x70
[c0000003f68bfa60] [c0000000001e54f8] .alloc_fdtable+0x88/0x130
[c0000003f68bfaf0] [c0000000001e5924] .dup_fd+0x384/0x450
[c0000003f68bfbd0] [c00000000009a310] .copy_process+0x880/0x11d0
[c0000003f68bfcd0] [c00000000009aee0] .do_fork+0x70/0x400
[c0000003f68bfdc0] [c0000000000141c4] .sys_clone+0x54/0x70
[c0000003f68bfe30] [c000000000009aa0] .ppc_clone+0x8/0xc

Fix that by complete removal of tty_kref_get/put in open/close/hangup
paths.

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Reported-and-tested-by: Michael Neuling <mikey@neuling.org>
Cc: Stephen Rothwell <sfr@canb.auug.org.au>
Cc: ppc-dev <linuxppc-dev@lists.ozlabs.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
TTY: hvsi, use tty from tty_port 2012-04-09T18:28:26+00:00 Jiri Slaby jslaby@suse.cz 2012-04-02T11:54:30+00:00 daea440215ae86bf9fdfe82420710ae749eb73c7 Now, we switch to the refcounted model and do not need hp->lock to protect hp->tty anymore. Signed-off-by: Jiri Slaby <jslaby@suse.cz> Cc: linuxppc-dev@lists.ozlabs.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
Now, we switch to the refcounted model and do not need hp->lock to
protect hp->tty anymore.

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: linuxppc-dev@lists.ozlabs.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
TTY: hvsi, sanitize uses of tty 2012-04-09T18:28:26+00:00 Jiri Slaby jslaby@suse.cz 2012-04-02T11:54:29+00:00 28c0447d743ba94562f981bf09dda61bc4cc6f3b - use tty, not hp->tty wherever possible - pass tty down to some functions and go to step one - do not defer tty_hangup calls -- it is as simple as schedule_work, so might be called with hp->lock held - do not defer tty buffer flips -- since the driver does not use low_latency (it cannot actually), the flip is a simple tail move plus schedule_work. It will make our life easier in the next patch. Signed-off-by: Jiri Slaby <jslaby@suse.cz> Cc: linuxppc-dev@lists.ozlabs.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
- use tty, not hp->tty wherever possible
- pass tty down to some functions and go to step one
- do not defer tty_hangup calls -- it is as simple as schedule_work,
  so might be called with hp->lock held
- do not defer tty buffer flips -- since the driver does not use
  low_latency (it cannot actually), the flip is a simple tail move
  plus schedule_work. It will make our life easier in the next patch.

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: linuxppc-dev@lists.ozlabs.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
TTY: hvsi, add tty_port 2012-04-09T18:28:26+00:00 Jiri Slaby jslaby@suse.cz 2012-04-02T11:54:28+00:00 d73a4e790d05151dadf8c6de84382411a8f073fd And use count from there. Signed-off-by: Jiri Slaby <jslaby@suse.cz> Cc: linuxppc-dev@lists.ozlabs.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
And use count from there.

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: linuxppc-dev@lists.ozlabs.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
TTY: hvsi, CLOCAL is not in tty->flags 2012-04-09T18:28:26+00:00 Jiri Slaby jslaby@suse.cz 2012-04-02T11:54:27+00:00 5f566051fbc3e7754f903b3b4bf67a44e0ae2d1a It is in termios cflags. So change the test in hvsi_recv_control to do the right thing. Previously it was actually testing TTY_LDISC_OPEN bit, i.e. whether an ldisc is active. And yes, it is most of the time. Signed-off-by: Jiri Slaby <jslaby@suse.cz> Cc: linuxppc-dev@lists.ozlabs.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
It is in termios cflags. So change the test in hvsi_recv_control to do
the right thing. Previously it was actually testing TTY_LDISC_OPEN
bit, i.e. whether an ldisc is active. And yes, it is most of the time.

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: linuxppc-dev@lists.ozlabs.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
TTY: hvcs, use tty from tty_port 2012-04-09T18:28:21+00:00 Jiri Slaby jslaby@suse.cz 2012-04-02T11:54:26+00:00 6968a7592a1f27386174617b6dbef31044da91ed No refcounting, just a switch. The locking in the driver prevents races, so in fact the refcounting is not needed. But while we have a tty in tty_port, don't duplicate that and remove the one from hvcs_struct. Signed-off-by: Jiri Slaby <jslaby@suse.cz> Cc: linuxppc-dev@lists.ozlabs.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
No refcounting, just a switch. The locking in the driver prevents
races, so in fact the refcounting is not needed. But while we have a
tty in tty_port, don't duplicate that and remove the one from
hvcs_struct.

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: linuxppc-dev@lists.ozlabs.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
TTY: hvcs, use kref from tty_port 2012-04-09T18:28:19+00:00 Jiri Slaby jslaby@suse.cz 2012-04-02T11:54:25+00:00 2cd9fa254508f71bd3025992ef5cecbf2120b0e4 A simple switch. Except we convert destroy_hvcs_struct to be tty_port_operations->destruct... Signed-off-by: Jiri Slaby <jslaby@suse.cz> Cc: linuxppc-dev@lists.ozlabs.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
A simple switch. Except we convert destroy_hvcs_struct to be
tty_port_operations->destruct...

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: linuxppc-dev@lists.ozlabs.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
TTY: hvcs, add tty_port 2012-04-09T18:28:18+00:00 Jiri Slaby jslaby@suse.cz 2012-04-02T11:54:24+00:00 1997cf044853a2d83cd0ebc307e292fa9fa819de And use count from there. Signed-off-by: Jiri Slaby <jslaby@suse.cz> Cc: linuxppc-dev@lists.ozlabs.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
And use count from there.

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: linuxppc-dev@lists.ozlabs.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
TTY: HVC, use count from tty_port 2012-04-09T18:28:18+00:00 Jiri Slaby jslaby@suse.cz 2012-04-02T11:54:23+00:00 0146b6939074ebe14ece3604fd00e7be128a3812 Now, count is used from tty_port and protected by tty_port->lock. n_outbuf is left unprotected in hvc_hangup now, because there is no point to hold any lock, since other uses are unprotected too. Signed-off-by: Jiri Slaby <jslaby@suse.cz> Cc: linuxppc-dev@lists.ozlabs.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
Now, count is used from tty_port and protected by tty_port->lock.

n_outbuf is left unprotected in hvc_hangup now, because there is no
point to hold any lock, since other uses are unprotected too.

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: linuxppc-dev@lists.ozlabs.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>