kernel/linux.git/drivers/tty/tty_io.c, branch v4.17.1

tty: Don't call panic() at tty_ldisc_init()

2018-04-23T09:05:52+00:00

syzbot is reporting kernel panic [1] triggered by memory allocation failure at tty_ldisc_get() from tty_ldisc_init(). But since both tty_ldisc_get() and caller of tty_ldisc_init() can cleanly handle errors, tty_ldisc_init() does not need to call panic() when tty_ldisc_get() failed. [1] https://syzkaller.appspot.com/bug?id=883431818e036ae6a9981156a64b821110f39187 Signed-off-by: Tetsuo Handa Reported-by: syzbot Cc: Greg Kroah-Hartman Cc: Jiri Slaby Cc: stable Signed-off-by: Greg Kroah-Hartman

tty: make n_tty_read() always abort if hangup is in progress

2018-02-28T12:21:10+00:00

A tty is hung up by __tty_hangup() setting file->f_op to hung_up_tty_fops, which is skipped on ttys whose write operation isn't tty_write(). This means that, for example, /dev/console whose write op is redirected_tty_write() is never actually marked hung up. Because n_tty_read() uses the hung up status to decide whether to abort the waiting readers, the lack of hung-up marking can lead to the following scenario. 1. A session contains two processes. The leader and its child. The child ignores SIGHUP. 2. The leader exits and starts disassociating from the controlling terminal (/dev/console). 3. __tty_hangup() skips setting f_op to hung_up_tty_fops. 4. SIGHUP is delivered and ignored. 5. tty_ldisc_hangup() is invoked. It wakes up the waits which should clear the read lockers of tty->ldisc_sem. 6. The reader wakes up but because tty_hung_up_p() is false, it doesn't abort and goes back to sleep while read-holding tty->ldisc_sem. 7. The leader progresses to tty_ldisc_lock() in tty_ldisc_hangup() and is now stuck in D sleep indefinitely waiting for tty->ldisc_sem. The following is Alan's explanation on why some ttys aren't hung up. http://lkml.kernel.org/r/20171101170908.6ad08580@alans-desktop 1. It broke the serial consoles because they would hang up and close down the hardware. With tty_port that *should* be fixable properly for any cases remaining. 2. The console layer was (and still is) completely broken and doens't refcount properly. So if you turn on console hangups it breaks (as indeed does freeing consoles and half a dozen other things). As neither can be fixed quickly, this patch works around the problem by introducing a new flag, TTY_HUPPING, which is used solely to tell n_tty_read() that hang-up is in progress for the console and the readers should be aborted regardless of the hung-up status of the device. The following is a sample hung task warning caused by this issue. INFO: task agetty:2662 blocked for more than 120 seconds. Not tainted 4.11.3-dbg-tty-lockup-02478-gfd6c7ee-dirty #28 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. 0 2662 1 0x00000086 Call Trace: __schedule+0x267/0x890 schedule+0x36/0x80 schedule_timeout+0x23c/0x2e0 ldsem_down_write+0xce/0x1f6 tty_ldisc_lock+0x16/0x30 tty_ldisc_hangup+0xb3/0x1b0 __tty_hangup+0x300/0x410 disassociate_ctty+0x6c/0x290 do_exit+0x7ef/0xb00 do_group_exit+0x3f/0xa0 get_signal+0x1b3/0x5d0 do_signal+0x28/0x660 exit_to_usermode_loop+0x46/0x86 do_syscall_64+0x9c/0xb0 entry_SYSCALL64_slow_path+0x25/0x25 The following is the repro. Run "$PROG /dev/console". The parent process hangs in D state. #include #include #include #include #include #include #include #include #include #include #include #include int main(int argc, char **argv) { struct sigaction sact = { .sa_handler = SIG_IGN }; struct timespec ts1s = { .tv_sec = 1 }; pid_t pid; int fd; if (argc < 2) { fprintf(stderr, "test-hung-tty /dev/$TTY\n"); return 1; } /* fork a child to ensure that it isn't already the session leader */ pid = fork(); if (pid < 0) { perror("fork"); return 1; } if (pid > 0) { /* top parent, wait for everyone */ while (waitpid(-1, NULL, 0) >= 0) ; if (errno != ECHILD) perror("waitpid"); return 0; } /* new session, start a new session and set the controlling tty */ if (setsid() < 0) { perror("setsid"); return 1; } fd = open(argv[1], O_RDWR); if (fd < 0) { perror("open"); return 1; } if (ioctl(fd, TIOCSCTTY, 1) < 0) { perror("ioctl"); return 1; } /* fork a child, sleep a bit and exit */ pid = fork(); if (pid < 0) { perror("fork"); return 1; } if (pid > 0) { nanosleep(&ts1s, NULL); printf("Session leader exiting\n"); exit(0); } /* * The child ignores SIGHUP and keeps reading from the controlling * tty. Because SIGHUP is ignored, the child doesn't get killed on * parent exit and the bug in n_tty makes the read(2) block the * parent's control terminal hangup attempt. The parent ends up in * D sleep until the child is explicitly killed. */ sigaction(SIGHUP, &sact, NULL); printf("Child reading tty\n"); while (1) { char buf[1024]; if (read(fd, buf, sizeof(buf)) < 0) { perror("read"); return 1; } } return 0; } Signed-off-by: Tejun Heo Cc: Alan Cox Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman

vfs: do bulk POLL* -> EPOLL* replacement

2018-02-11T22:34:03+00:00

This is the mindless scripted replacement of kernel use of POLL* variables as described by Al, done by this script: for V in IN OUT PRI ERR RDNORM RDBAND WRNORM WRBAND HUP RDHUP NVAL MSG; do L=`git grep -l -w POLL$V | grep -v '^t' | grep -v /um/ | grep -v '^sa' | grep -v '/poll.h$'|grep -v '^D'` for f in $L; do sed -i "-es/^$[^\"]*$$\$/\\1E\\2/" $f; done done with de-mangling cleanups yet to come. NOTE! On almost all architectures, the EPOLL* constants have the same values as the POLL* constants do. But they keyword here is "almost". For various bad reasons they aren't the same, and epoll() doesn't actually work quite correctly in some cases due to this on Sparc et al. The next patch from Al will sort out the final differences, and we should be all done. Scripted-by: Al Viro Signed-off-by: Linus Torvalds

Merge tag 'tty-4.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

2018-02-01T17:46:00+00:00

Pull tty/staging driver updates from Greg KH: "Here is the big tty/serial driver update for 4.16-rc1. The usual number of various serial driver fixes and updates to try to get them to work with crazy hardware configurations (seriously, how many different ways are hardware engineers going to come up with to hook up a simple UART?) There is also some serdev bugfixes and updates, as well as a smattering of other small fixes in here. All have been in the linux-next tree for a while, with no reported issues" * tag 'tty-4.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (65 commits) tty: serial: exar: Relocate sleep wake-up handling tty: fix data race between tty_init_dev and flush of buf serial: imx: fix endless loop during suspend serial: core: mark port as initialized after successful IRQ change serdev: only match serdev devices serdev: do not generate modaliases for controllers serial: mxs-auart: don't use GPIOF_* with gpiod_get_direction serial: 8250_dw: Revert "Improve clock rate setting" MAINTAINERS: Add myself as designated reviewer for 8250_dw gpio: serial: max310x: Support open-drain configuration for GPIOs serdev: Fix serdev_uevent failure on ACPI enumerated serdev-controllers serial: 8250_ingenic: Parse earlycon options serial: 8250_ingenic: Add support for the JZ4770 SoC serial: core: Make uart_parse_options take const char* argument serial: 8250_of: fix return code when probe function fails to get reset serial: imx: Only wakeup via RTSDEN bit if the system has RTS/CTS serial: 8250_uniphier: fix error return code in uniphier_uart_probe() tty: n_gsm: Allow ADM response in addition to UA for control dlci tty: omap-serial: Fix initial on-boot RTS GPIO level tty: serial: jsm: Add one check against NULL pointer dereference ...

tty: fix data race between tty_init_dev and flush of buf

2018-01-23T07:57:37+00:00

There can be a race, if receive_buf call comes before tty initialization completes in n_tty_open and tty->disc_data may be NULL. CPU0 CPU1 ---- ---- 000|n_tty_receive_buf_common() n_tty_open() -001|n_tty_receive_buf2() tty_ldisc_open.isra.3() -002|tty_ldisc_receive_buf(inline) tty_ldisc_setup() Using ldisc semaphore lock in tty_init_dev till disc_data initializes completely. Signed-off-by: Gaurav Kohli Reviewed-by: Alan Cox Cc: stable Signed-off-by: Greg Kroah-Hartman

pty: cancel pty slave port buf's work in tty_release

2017-12-19T08:59:51+00:00

In case that CONFIG_SLUB_DEBUG is on and pty is used, races between release_one_tty and flush_to_ldisc work threads may happen and lead to use-after-free condition on tty->link->port. Because SLUB_DEBUG is turned on, freed tty->link->port is filled with POISON_FREE value. So far without SLUB_DEBUG, port was filled with zero and flush_to_ldisc could return without a problem by checking if tty is NULL. CPU 0 CPU 1 ----- ----- release_tty pty_write cancel_work_sync(tty) to = tty->link tty_kref_put(tty->link) tty_schedule_flip(to->port) << workqueue >> ... release_one_tty ... pty_cleanup ... kfree(tty->link->port) << workqueue >> flush_to_ldisc tty = READ_ONCE(port->itty) tty is 0x6b6b6b6b6b6b6b6b !!PANIC!! access tty->ldisc Unable to handle kernel paging request at virtual address 6b6b6b6b6b6b6b93 pgd = ffffffc0eb1c3000 [6b6b6b6b6b6b6b93] *pgd=0000000000000000, *pud=0000000000000000 ------------[ cut here ]------------ Kernel BUG at ffffff800851154c [verbose debug info unavailable] Internal error: Oops - BUG: 96000004 [#1] PREEMPT SMP CPU: 3 PID: 265 Comm: kworker/u8:9 Tainted: G W 3.18.31-g0a58eeb #1 Hardware name: Qualcomm Technologies, Inc. MSM 8996pro v1.1 + PMI8996 Carbide (DT) Workqueue: events_unbound flush_to_ldisc task: ffffffc0ed610ec0 ti: ffffffc0ed624000 task.ti: ffffffc0ed624000 PC is at ldsem_down_read_trylock+0x0/0x4c LR is at tty_ldisc_ref+0x24/0x4c pc : [] lr : [] pstate: 80400145 sp : ffffffc0ed627cd0 x29: ffffffc0ed627cd0 x28: 0000000000000000 x27: ffffff8009e05000 x26: ffffffc0d382cfa0 x25: 0000000000000000 x24: ffffff800a012f08 x23: 0000000000000000 x22: ffffffc0703fbc88 x21: 6b6b6b6b6b6b6b6b x20: 6b6b6b6b6b6b6b93 x19: 0000000000000000 x18: 0000000000000001 x17: 00e80000f80d6f53 x16: 0000000000000001 x15: 0000007f7d826fff x14: 00000000000000a0 x13: 0000000000000000 x12: 0000000000000109 x11: 0000000000000000 x10: 0000000000000000 x9 : ffffffc0ed624000 x8 : ffffffc0ed611580 x7 : 0000000000000000 x6 : ffffff800a42e000 x5 : 00000000000003fc x4 : 0000000003bd1201 x3 : 0000000000000001 x2 : 0000000000000001 x1 : ffffff800851004c x0 : 6b6b6b6b6b6b6b93 Signed-off-by: Sahara Signed-off-by: Greg Kroah-Hartman

the rest of drivers/*: annotate ->poll() instances

2017-11-28T16:06:58+00:00

Signed-off-by: Al Viro

anntotate the places where ->poll() return values go

2017-11-27T21:19:53+00:00

Signed-off-by: Al Viro

tty: add SPDX identifiers to all remaining files in drivers/tty/

2017-11-08T12:08:12+00:00

It's good to have SPDX identifiers in all files to make it easier to audit the kernel tree for correct licenses. Update the drivers/tty files files with the correct SPDX license identifier based on the license text in the file itself. The SPDX identifier is a legally binding shorthand, which can be used instead of the full boiler plate text. This work is based on a script and data from Thomas Gleixner, Philippe Ombredanne, and Kate Stewart. Cc: Jiri Slaby Cc: Benjamin Herrenschmidt Cc: Paul Mackerras Cc: Michael Ellerman Cc: Chris Metcalf Cc: Jiri Kosina Cc: David Sterba Cc: James Hogan Cc: Rob Herring Cc: Eric Anholt Cc: Stefan Wahren Cc: Florian Fainelli Cc: Ray Jui Cc: Scott Branden Cc: bcm-kernel-feedback-list@broadcom.com Cc: "James E.J. Bottomley" Cc: Helge Deller Cc: Joachim Eastwood Cc: Matthias Brugger Cc: Masahiro Yamada Cc: Tobias Klauser Cc: Russell King Cc: Vineet Gupta Cc: Richard Genoud Cc: Alexander Shiyan Cc: Baruch Siach Cc: "Maciej W. Rozycki" Cc: "Uwe Kleine-König" Cc: Pat Gefre Cc: "Guilherme G. Piccoli" Cc: Jason Wessel Cc: Vladimir Zapolskiy Cc: Sylvain Lemieux Cc: Carlo Caione Cc: Kevin Hilman Cc: Liviu Dudau Cc: Sudeep Holla Cc: Lorenzo Pieralisi Cc: Andy Gross Cc: David Brown Cc: "Andreas Färber" Cc: Kevin Cernekee Cc: Laxman Dewangan Cc: Thierry Reding Cc: Jonathan Hunter Cc: Barry Song Cc: Patrice Chotard Cc: Maxime Coquelin Cc: Alexandre Torgue Cc: "David S. Miller" Cc: Peter Korsgaard Cc: Timur Tabi Cc: Tony Prisk Cc: Michal Simek Cc: "Sören Brinkmann" Cc: Thomas Gleixner Cc: Kate Stewart Cc: Philippe Ombredanne Cc: Jiri Slaby Signed-off-by: Greg Kroah-Hartman

Merge tag 'staging-4.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging

2017-09-05T17:36:26+00:00

Pull staging/IIO driver updates from Greg KH: "Here is the big staging and IIO driver update for 4.14-rc1. Lots of staging driver fixes and cleanups, including some reorginizing of the lustre header files to try to impose some sanity on what is, and what is not, the uapi for that filesystem. There are some tty core changes in here as well, as the speakup drivers need them, and that's ok with me, they are sane and the speakup code is getting nicer because of it. There is also the addition of the obiligatory new wifi driver, just because it has been a release or two since we added our last one... Other than that, lots and lots of small coding style fixes, as usual. All of these have been in linux-next for a while with no reported issues" * tag 'staging-4.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (612 commits) staging:rtl8188eu:core Fix remove unneccessary else block staging: typec: fusb302: make structure fusb302_psy_desc static staging: unisys: visorbus: make two functions static staging: fsl-dpaa2/eth: fix off-by-one FD ctrl bitmaks staging: r8822be: Simplify deinit_priv() staging: r8822be: Remove some dead code staging: vboxvideo: Use CONFIG_DRM_KMS_FB_HELPER to check for fbdefio availability staging:rtl8188eu Fix comparison to NULL staging: rts5208: rename mmc_ddr_tunning_rx_cmd to mmc_ddr_tuning_rx_cmd Staging: Pi433: style fix - tabs and spaces staging: pi433: fix spelling mistake: "preample" -> "preamble" staging:rtl8188eu:core Fix Code Indent staging: typec: fusb302: Export current-limit through a power_supply class dev staging: typec: fusb302: Add support for USB2 charger detection through extcon staging: typec: fusb302: Use client->irq as irq if set staging: typec: fusb302: Get max snk mv/ma/mw from device-properties staging: typec: fusb302: Set max supply voltage to 5V staging: typec: tcpm: Add get_current_limit tcpc_dev callback staging:rtl8188eu Use __func__ instead of function name staging: lustre: coding style fixes found by checkpatch.pl ...