Received: by 2002:a25:8b91:0:0:0:0:0 with SMTP id j17csp5034511ybl; Tue, 14 Jan 2020 02:21:09 -0800 (PST) X-Google-Smtp-Source: APXvYqzJkLal7gQu5aj2XTlxfZmcDXydoe0yZhQ+p6P6Tj2dtWBi5tWn6fVJSN3kp1f1zM3/nf0V X-Received: by 2002:a05:6830:1188:: with SMTP id u8mr16557463otq.274.1578997269265; Tue, 14 Jan 2020 02:21:09 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1578997269; cv=none; d=google.com; s=arc-20160816; b=HX2sdo2f8Yr/0L0X0oOFDaeGpEZWT+aR7uaxFIzdIm3wDwK2cXc6meIJTYoyhWWFLb BzwX+7HyNZQ0FbUss6dT4qjA7KUo5ISSKZhl8TqY06DXQmABPtGWkCX/Z4muCpW9Jrsx kNqog95iHJo9nT7VjQNOX0ZB4JkgXNb/YOWF78ft3LZOceZMdsR8lgUDoNzk0oMj1D1W e10BSsDI0c4v0ylzDBtmnwex3yB1DyNtsy+J1yWMsLBLneS8tMHwdDZkCBvF8XOyWi7d Iv75SPVHaLOZTAWsr1VKpUGx5/eewKifJAycLLU09m33A8sAloTha9nFP9a6CW2vqoL6 zzHQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=Wy2ca/GOk4p5YtWbwh1s2+6bLYHt/n2LTHBFFFuxWCQ=; b=eoOn3aW82Y39+Ak0qOEXI5mn8J2lSPP5pc/E+SP+hYKz92HHhWCNPjxvttL1pZPmkF S9R8eDSe0o9xeHVoFWakWJF14lW9+q8hYZ/yQBTvYwy3GLppk6G5fHmUJYIGaMF4CNmq uZaQaxgCacun12ufLBBDlZYkiqOkGgY9+NVL8owVr4wunBDhDnp+WwfrmcXweu8efGBL XeQcXvRUqeYNh85h9NILrCd9Nbj8jLarqIVbH+B8MVOwn7/K9h7VxlJx4A00aZsaIIoD Fn6kPutaMDxSKFQdXivv8RfryXfftcLdTnXFRGoUdAbqMnEVp0ZuQJSoJD+mpCiKZ+om L7FA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=EejMWe6x; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id g4si7584852oia.179.2020.01.14.02.20.58; Tue, 14 Jan 2020 02:21:09 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=EejMWe6x; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730122AbgANKFX (ORCPT + 99 others); Tue, 14 Jan 2020 05:05:23 -0500 Received: from mail.kernel.org ([198.145.29.99]:33302 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729447AbgANKFS (ORCPT ); Tue, 14 Jan 2020 05:05:18 -0500 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 63A322467D; Tue, 14 Jan 2020 10:05:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578996318; bh=9mG7apXH3z1oevkdoVIIupPDJz8NHaoIfmcZ4hXq3dk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=EejMWe6xGSD5/qAchl4t+vG81xaiU1zszr64G94v0LvoEqyY6HoeoXN+FoRPckK1c 1n5jD+73KQR1SM54ffYL8f8bK/5o9TNsWrTSdcFqA2n6cC+zrXhL+IChnuPXKNCcWN lbs37+EpDJUPCfyOd6vWMgOFq7HXl3tkd7gHvgfs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jiri Slaby , Sudip Mukherjee Subject: [PATCH 5.4 55/78] tty: link tty and port before configuring it as console Date: Tue, 14 Jan 2020 11:01:29 +0100 Message-Id: <20200114094400.846717319@linuxfoundation.org> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20200114094352.428808181@linuxfoundation.org> References: <20200114094352.428808181@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Sudip Mukherjee commit fb2b90014d782d80d7ebf663e50f96d8c507a73c upstream. There seems to be a race condition in tty drivers and I could see on many boot cycles a NULL pointer dereference as tty_init_dev() tries to do 'tty->port->itty = tty' even though tty->port is NULL. 'tty->port' will be set by the driver and if the driver has not yet done it before we open the tty device we can get to this situation. By adding some extra debug prints, I noticed that: 6.650130: uart_add_one_port 6.663849: register_console 6.664846: tty_open 6.674391: tty_init_dev 6.675456: tty_port_link_device uart_add_one_port() registers the console, as soon as it registers, the userspace tries to use it and that leads to tty_open() but uart_add_one_port() has not yet done tty_port_link_device() and so tty->port is not yet configured when control reaches tty_init_dev(). Further look into the code and tty_port_link_device() is done by uart_add_one_port(). After registering the console uart_add_one_port() will call tty_port_register_device_attr_serdev() and tty_port_link_device() is called from this. Call add tty_port_link_device() before uart_configure_port() is done and add a check in tty_port_link_device() so that it only links the port if it has not been done yet. Suggested-by: Jiri Slaby Signed-off-by: Sudip Mukherjee Cc: stable Link: https://lore.kernel.org/r/20191212131602.29504-1-sudipm.mukherjee@gmail.com Signed-off-by: Greg Kroah-Hartman --- drivers/tty/serial/serial_core.c | 1 + drivers/tty/tty_port.c | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-) --- a/drivers/tty/serial/serial_core.c +++ b/drivers/tty/serial/serial_core.c @@ -2834,6 +2834,7 @@ int uart_add_one_port(struct uart_driver if (uport->cons && uport->dev) of_console_check(uport->dev->of_node, uport->cons->name, uport->line); + tty_port_link_device(port, drv->tty_driver, uport->line); uart_configure_port(drv, state, uport); port->console = uart_console(uport); --- a/drivers/tty/tty_port.c +++ b/drivers/tty/tty_port.c @@ -89,7 +89,8 @@ void tty_port_link_device(struct tty_por { if (WARN_ON(index >= driver->num)) return; - driver->ports[index] = port; + if (!driver->ports[index]) + driver->ports[index] = port; } EXPORT_SYMBOL_GPL(tty_port_link_device);