kernel.git/drivers/char/ttyprintk.c, branch linux-4.9.y

ttyprintk: Add TTY hangup callback.

2021-05-22T08:40:25Z

[ Upstream commit c0070e1e60270f6a1e09442a9ab2335f3eaeaad2 ] syzbot is reporting hung task due to flood of tty_warn(tty, "%s: tty->count = 1 port count = %d\n", __func__, port->count); message [1], for ioctl(TIOCVHANGUP) prevents tty_port_close() from decrementing port->count due to tty_hung_up_p() == true. ---------- #include #include #include #include #include int main(int argc, char *argv[]) { int i; int fd[10]; for (i = 0; i < 10; i++) fd[i] = open("/dev/ttyprintk", O_WRONLY); ioctl(fd[0], TIOCVHANGUP); for (i = 0; i < 10; i++) close(fd[i]); close(open("/dev/ttyprintk", O_WRONLY)); return 0; } ---------- When TTY hangup happens, port->count needs to be reset via "struct tty_operations"->hangup callback. [1] https://syzkaller.appspot.com/bug?id=39ea6caa479af471183997376dc7e90bc7d64a6a Reported-by: syzbot Reported-by: syzbot Tested-by: syzbot Signed-off-by: Tetsuo Handa Fixes: 24b4b67d17c308aa ("add ttyprintk driver") Link: https://lore.kernel.org/r/17e0652d-89b7-c8c0-fb53-e7566ac9add4@i-love.sakura.ne.jp Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin

ttyprintk: fix a potential deadlock in interrupt context issue

2020-02-05T13:05:47Z

commit 9a655c77ff8fc65699a3f98e237db563b37c439b upstream. tpk_write()/tpk_close() could be interrupted when holding a mutex, then in timer handler tpk_write() may be called again trying to acquire same mutex, lead to deadlock. Google syzbot reported this issue with CONFIG_DEBUG_ATOMIC_SLEEP enabled: BUG: sleeping function called from invalid context at kernel/locking/mutex.c:938 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 0, name: swapper/1 1 lock held by swapper/1/0: ... Call Trace: dump_stack+0x197/0x210 ___might_sleep.cold+0x1fb/0x23e __might_sleep+0x95/0x190 __mutex_lock+0xc5/0x13c0 mutex_lock_nested+0x16/0x20 tpk_write+0x5d/0x340 resync_tnc+0x1b6/0x320 call_timer_fn+0x1ac/0x780 run_timer_softirq+0x6c3/0x1790 __do_softirq+0x262/0x98c irq_exit+0x19b/0x1e0 smp_apic_timer_interrupt+0x1a3/0x610 apic_timer_interrupt+0xf/0x20 See link https://syzkaller.appspot.com/bug?extid=2eeef62ee31f9460ad65 for more details. Fix it by using spinlock in process context instead of mutex and having interrupt disabled in critical section. Reported-by: syzbot+2eeef62ee31f9460ad65@syzkaller.appspotmail.com Signed-off-by: Zhenzhong Duan Cc: Arnd Bergmann Cc: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20200113034842.435-1-zhenzhong.duan@gmail.com Signed-off-by: Greg Kroah-Hartman

ttyprintk: Neaten and simplify printing

2016-09-13T15:30:17Z

The code is a bit obscure. Simplify it by using a single routine to flush the tpk_buffer and emit the buffer prefixed with "[U] ". Signed-off-by: Joe Perches Signed-off-by: Greg Kroah-Hartman

char: constify tty_port_operations structs

2016-02-07T07:31:08Z

Constifies tty_port_operations structure in the char driver since it is not modified after its initialization. Detected and found using Coccinelle. Suggested-by: Julia Lawall Signed-off-by: Aya Mahfouz Acked-by: Arnd Bergmann Signed-off-by: Greg Kroah-Hartman

ttyprintk: Allow built as a module

2014-04-16T21:21:06Z

The driver is well written to be used as a module, just the exit call is missing. Reviewed-by: Jean Delvare Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman

ttyprintk: Fix wrong tty_unregister_driver() call in the error path

2014-04-16T21:21:06Z

ttyprintk driver calls tty_unregister_driver() wrongly in the error path of tty_register_driver(). Also, setting ttyprintk_driver to NULL is utterly superfluous, so let's get rid of it, too. Reported-by: Jean Delvare Reviewed-by: Jean Delvare Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman

drivers/char: don't use module_init in non-modular ttyprintk.c

2014-01-13T22:57:20Z

The TTY_PRINTK option is bool, and hence this code is either present or absent. It will never be modular, so using module_init as an alias for __initcall is rather misleading. Fix this up now, so that we can relocate module_init from init.h into module.h in the future. If we don't do this, we'd have to add module.h to obviously non-modular code, and that would be a worse thing. Note that direct use of __initcall is discouraged, vs. one of the priority categorized subgroups. As __initcall gets mapped onto device_initcall, our use of device_initcall directly in this change means that the runtime impact is zero -- it will remain at level 6 in initcall ordering. Signed-off-by: Paul Gortmaker Signed-off-by: Greg Kroah-Hartman

ttyprintk: Fix NULL pointer deref by setting tty_port ops after initializing port

2013-05-21T17:13:23Z

tty_port_init() zeroes out the tty port, which means that we have to set the ops pointer /after/, not before this call. Otherwise, tty_port_open will crash when it tries to deref ops, which is now a NULL pointer. Signed-off-by: Darrick J. Wong Signed-off-by: Greg Kroah-Hartman

TTY: call tty_port_destroy in the rest of drivers

2012-11-16T01:20:58Z

After commit "TTY: move tty buffers to tty_port", the tty buffers are not freed in some drivers. This is because tty_port_destructor is not called whenever a tty_port is freed. This was an assumption I counted with but was unfortunately untrue. So fix the drivers to fulfil this assumption. To be sure, the TTY buffers (and later some stuff) are gone along with the tty_port, we have to call tty_port_destroy at tear-down places. This is mostly where the structure containing a tty_port is freed. This patch does exactly that -- put tty_port_destroy at those places. Signed-off-by: Jiri Slaby Signed-off-by: Greg Kroah-Hartman

TTY: tty_alloc_driver() returns error pointers

2012-08-16T19:07:23Z

We changed these from alloc_tty_driver() to tty_alloc_driver() so the error handling needs to modified to check for IS_ERR() instead of NULL. Signed-off-by: Dan Carpenter Acked-by: Jiri Slaby Signed-off-by: Greg Kroah-Hartman