Received: by 2002:a25:7ec1:0:0:0:0:0 with SMTP id z184csp3373357ybc; Thu, 21 Nov 2019 07:25:18 -0800 (PST) X-Google-Smtp-Source: APXvYqzRopMsckGO2t0QxVRgPLf1iNsX+fX9URE022q4CCSI8DFQEjuiD4y7qMEswLx2lyF8QH0f X-Received: by 2002:a17:906:27ca:: with SMTP id k10mr14115596ejc.242.1574349918834; Thu, 21 Nov 2019 07:25:18 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1574349918; cv=none; d=google.com; s=arc-20160816; b=HRvr+LpzfHZ5ojz82HRLzjq3/b1qzl37xnCu62WkTftH7spqw1wWuTe2XT3jOVC2rp AoMYD2fnHa2fTup7a7OJMjeSKxWoRKixXCZE1pOnidzl2KySPALeLFjOAMRq769sTQ/W VCanES0oJLh5wkkzcFbS9zzwbN+BryCdY3EWY4hI2TMArEcDAcagxmYArMNTvq7gJHQq X12ScJ5cZn3KBLo8Emt2F6dH0JlNFNHQVdnwJiZQjSj5SyMRLqsWnNoXGSrXtqbG+ZoL MmQuYWZqZxGBGyQDon83FYWFyGVHRZBS80ZSniZVv0e4t8XLCg9MQvOh8Pe6iNZfaF6w P0zw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:references:in-reply-to:message-id:date :subject:cc:to:from:dkim-signature; bh=/QUadaJCeZcD2+8+mKTLJYldkMqUQ027wQBvZHXhl6Y=; b=fLeGwuyvjjsOmZ4u57V66zGcCdokG6a2gq1/RZDrTGqBJlIGxTNoK/2Q8SJdYsDA8C Xt2O4n09KyUMjpdrxDPXgM83bOIdA+AuEYKEuYsxuIFvswr1MYwvVwFYKHh+W3FByz/+ XdaBi1WtnsH/xOX7dfSp1G+r72cW2mCzgPugPGcsOKEx2zjhY0/gcFl5yMO6g+3jfcZt q/nGiauVi16H4f3vliOdwZj6xzNeYdxJCDc9Yc/mOoTnp11OCZgOz/vSMYtR7lQ63nv9 JXaBT6Mr3tTBfrNrwvNDwbcZLHtaEkllLLQp3l0+Sks6QgglfkmwZQq+325AINbZ83Yz ZdxQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gmail.com header.s=20161025 header.b=gG6UV0jN; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id y16si2044320ejp.400.2019.11.21.07.24.54; Thu, 21 Nov 2019 07:25:18 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@gmail.com header.s=20161025 header.b=gG6UV0jN; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727406AbfKUPWq (ORCPT + 99 others); Thu, 21 Nov 2019 10:22:46 -0500 Received: from mail-wm1-f66.google.com ([209.85.128.66]:51279 "EHLO mail-wm1-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726563AbfKUPWp (ORCPT ); Thu, 21 Nov 2019 10:22:45 -0500 Received: by mail-wm1-f66.google.com with SMTP id g206so3897616wme.1 for ; Thu, 21 Nov 2019 07:22:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=/QUadaJCeZcD2+8+mKTLJYldkMqUQ027wQBvZHXhl6Y=; b=gG6UV0jNI2NeY850UKoCqYROQ9KetXMU9fgBVP0OoLCUwQrsA/Xy9cFp2O0szlc1R8 a1ELzKti/pqs+uI4pF5jiGnqUQGQ2ttOvGr24NXb0Y8rZNJKvTU9+DE1tXf2OInsKAbJ ZSJbljPJ2rs7316lPrDiDcXPFwZXcQ7UEqw8ihl5KHvWWgQLVpSyWhDL8TXBP0clzYT9 Bi2SRoefLqRUu3IZFxooeoTFYyvdunID9gpYl8E/rOGqwdKv8hqtgZjU2hXXsoCRQ0eg B18VV2UCvLUTBQ7B2AoH9dmsc7h8E3uq8wEhJA2AkPsCBtnIIgweNqrJTIyF2/QXj2ZX GJXQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=/QUadaJCeZcD2+8+mKTLJYldkMqUQ027wQBvZHXhl6Y=; b=OXHcPZAUo8qcJxBQi/aMq1tN7+R/kZ332OHR0ujgM5OTmyd0CF+Z+aDXR1EIyrfLJP Lok8pmZ7JwPj2es7EsYt8zNozqAfrZ5Zu6mqy/yZv9pWlhPhqrqS8QS8C1IZma047dFN KNEmSecovAvpdQlDtSCg+tGynXsmcEhvgeb1WH1VH4sj1B+y0mk194+TZ5VlJheowxns OANYJuuUI8sZvqNiJMLoLT5dteDneEr+YqxsKa7ZfPILyIJZuSipFB3L+Zv67QLSFQpn ZHYPwGutnV4LySRD8LH9JUdHCqFIduqvDVOCHVd3fUDvAvrJVgJqEupd0bJeXQ57dmuv iUYw== X-Gm-Message-State: APjAAAWUY8Lr31OdV1/s1Bhzk2/UHNQy7R6wpriZ8LLrdVSh+FlNr5Lu hL7khHkwSXRSUgnDKoaRvWg= X-Received: by 2002:a1c:a78b:: with SMTP id q133mr10578720wme.115.1574349763302; Thu, 21 Nov 2019 07:22:43 -0800 (PST) Received: from debian.office.codethink.co.uk ([167.98.27.226]) by smtp.gmail.com with ESMTPSA id t12sm3499467wrx.93.2019.11.21.07.22.42 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 21 Nov 2019 07:22:42 -0800 (PST) From: Sudip Mukherjee To: Greg Kroah-Hartman , Jiri Slaby Cc: linux-kernel@vger.kernel.org, Sudip Mukherjee Subject: [PATCH v2 2/2] tty: use tty_init_dev_retry() to workaround a race condition Date: Thu, 21 Nov 2019 15:22:39 +0000 Message-Id: <20191121152239.28405-2-sudipm.mukherjee@gmail.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20191121152239.28405-1-sudipm.mukherjee@gmail.com> References: <20191121152239.28405-1-sudipm.mukherjee@gmail.com> Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org There seems to be a race condition in tty drivers and I could see on many boot cycles a NULL pointer dereference as tty_init_dev() tries to do 'tty->port->itty = tty' even though tty->port is NULL. 'tty->port' will be set by the driver and if the driver has not yet done it before we open the tty device we can get to this situation. By adding some extra debug prints, I noticed that: 6.650130: uart_add_one_port 6.663849: register_console 6.664846: tty_open 6.674391: tty_init_dev 6.675456: tty_port_link_device uart_add_one_port() registers the console, as soon as it registers, the userspace tries to use it and that leads to tty_open() but uart_add_one_port() has not yet done tty_port_link_device() and so tty->port is not yet configured when control reaches tty_init_dev(). So, add one retry and use tty_init_dev_retry(). Signed-off-by: Sudip Mukherjee --- v1: had some hardcoded numbers which were difficult to understand. https://lore.kernel.org/lkml/20191120151709.14148-2-sudipm.mukherjee@gmail.com/ I know this is not a proper fix, and the proper fix should have been to have a lock. But that will be too intrusive and adding retry was a safer option than that. drivers/tty/tty_io.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c index 95d7abeca254..f71a11895230 100644 --- a/drivers/tty/tty_io.c +++ b/drivers/tty/tty_io.c @@ -1945,6 +1945,7 @@ EXPORT_SYMBOL_GPL(tty_kopen); /** * tty_open_by_driver - open a tty device * @device: dev_t of device to open + * @retry: number of times to retry if tty_init_dev_retry fails * @filp: file pointer to tty * * Performs the driver lookup, checks for a reopen, or otherwise @@ -1957,7 +1958,7 @@ EXPORT_SYMBOL_GPL(tty_kopen); * - concurrent tty driver removal w/ lookup * - concurrent tty removal from driver table */ -static struct tty_struct *tty_open_by_driver(dev_t device, +static struct tty_struct *tty_open_by_driver(dev_t device, int retry, struct file *filp) { struct tty_struct *tty; @@ -2001,7 +2002,7 @@ static struct tty_struct *tty_open_by_driver(dev_t device, tty = ERR_PTR(retval); } } else { /* Returns with the tty_lock held for now */ - tty = tty_init_dev(driver, index); + tty = tty_init_dev_retry(driver, index, retry); mutex_unlock(&tty_mutex); } out: @@ -2036,7 +2037,7 @@ static struct tty_struct *tty_open_by_driver(dev_t device, static int tty_open(struct inode *inode, struct file *filp) { struct tty_struct *tty; - int noctty, retval; + int noctty, retval, retry = 1; dev_t device = inode->i_rdev; unsigned saved_flags = filp->f_flags; @@ -2049,7 +2050,7 @@ static int tty_open(struct inode *inode, struct file *filp) tty = tty_open_current_tty(device, filp); if (!tty) - tty = tty_open_by_driver(device, filp); + tty = tty_open_by_driver(device, retry--, filp); if (IS_ERR(tty)) { tty_free_file(filp); -- 2.11.0