From: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
To: "Samo Pogačnik" <samo_pogacnik@t-2.net>,
"Greg Kroah-Hartman" <gregkh@linuxfoundation.org>,
"Jiri Slaby" <jirislaby@kernel.org>
Cc: Petr Mladek <pmladek@suse.com>,
Sergey Senozhatsky <sergey.senozhatsky@gmail.com>,
Steven Rostedt <rostedt@goodmis.org>,
John Ogness <john.ogness@linutronix.de>,
linux-kernel@vger.kernel.org,
syzkaller-bugs <syzkaller-bugs@googlegroups.com>
Subject: [PATCH] ttyprintk: Add TTY hangup callback.
Date: Thu, 15 Apr 2021 09:22:22 +0900 [thread overview]
Message-ID: <17e0652d-89b7-c8c0-fb53-e7566ac9add4@i-love.sakura.ne.jp> (raw)
In-Reply-To: <31a4dec3d36ed131402244693cae180816ebd4d7.camel@t-2.net>
syzbot is reporting hung task due to flood of
tty_warn(tty, "%s: tty->count = 1 port count = %d\n", __func__,
port->count);
message [1], for ioctl(TIOCVHANGUP) prevents tty_port_close() from
decrementing port->count due to tty_hung_up_p() == true.
----------
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#include <unistd.h>
int main(int argc, char *argv[])
{
int i;
int fd[10];
for (i = 0; i < 10; i++)
fd[i] = open("/dev/ttyprintk", O_WRONLY);
ioctl(fd[0], TIOCVHANGUP);
for (i = 0; i < 10; i++)
close(fd[i]);
close(open("/dev/ttyprintk", O_WRONLY));
return 0;
}
----------
When TTY hangup happens, port->count needs to be reset via
"struct tty_operations"->hangup callback.
[1] https://syzkaller.appspot.com/bug?id=39ea6caa479af471183997376dc7e90bc7d64a6a
Reported-by: syzbot <syzbot+43e93968b964e369db0b@syzkaller.appspotmail.com>
Reported-by: syzbot <syzbot+3ed715090790806d8b18@syzkaller.appspotmail.com>
Tested-by: syzbot <syzbot+43e93968b964e369db0b@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Fixes: 24b4b67d17c308aa ("add ttyprintk driver")
---
drivers/char/ttyprintk.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/drivers/char/ttyprintk.c b/drivers/char/ttyprintk.c
index 6a0059e508e3..93f5d11c830b 100644
--- a/drivers/char/ttyprintk.c
+++ b/drivers/char/ttyprintk.c
@@ -158,12 +158,23 @@ static int tpk_ioctl(struct tty_struct *tty,
return 0;
}
+/*
+ * TTY operations hangup function.
+ */
+static void tpk_hangup(struct tty_struct *tty)
+{
+ struct ttyprintk_port *tpkp = tty->driver_data;
+
+ tty_port_hangup(&tpkp->port);
+}
+
static const struct tty_operations ttyprintk_ops = {
.open = tpk_open,
.close = tpk_close,
.write = tpk_write,
.write_room = tpk_write_room,
.ioctl = tpk_ioctl,
+ .hangup = tpk_hangup,
};
static const struct tty_port_operations null_ops = { };
--
2.18.4
next prev parent reply other threads:[~2021-04-15 0:22 UTC|newest]
Thread overview: 43+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-04-03 4:14 [PATCH] tty: use printk_safe context at tty_msg() Tetsuo Handa
2021-04-03 6:52 ` kernel test robot
2021-04-03 10:11 ` [PATCH] printk: Make multiple inclusion of kernel/printk/internal.h safe Tetsuo Handa
2021-04-06 4:51 ` [PATCH] tty: use printk_safe context at tty_msg() Jiri Slaby
2021-04-06 5:31 ` Tetsuo Handa
2021-04-06 7:10 ` Greg Kroah-Hartman
2021-04-06 11:16 ` Tetsuo Handa
2021-04-06 13:42 ` Greg Kroah-Hartman
2021-04-06 15:10 ` Petr Mladek
2021-04-06 16:22 ` Tetsuo Handa
2021-04-06 19:10 ` Greg Kroah-Hartman
2021-04-07 9:20 ` Petr Mladek
2021-04-07 13:26 ` [PATCH v2] tty: use printk_deferred() " Tetsuo Handa
2021-04-07 13:48 ` Greg Kroah-Hartman
2021-04-07 14:24 ` Tetsuo Handa
2021-04-12 10:39 ` How to handle concurrent access to /dev/ttyprintk ? Tetsuo Handa
2021-04-12 10:44 ` Greg Kroah-Hartman
2021-04-12 11:25 ` Tetsuo Handa
2021-04-12 12:04 ` Greg Kroah-Hartman
2021-04-14 0:45 ` Tetsuo Handa
2021-04-14 11:11 ` Tetsuo Handa
2021-04-14 16:15 ` Samo Pogačnik
2021-04-15 0:22 ` Tetsuo Handa [this message]
2021-04-18 11:16 ` [PATCH] ttyprintk: Add TTY hangup callback Samo Pogačnik
2021-04-22 10:02 ` Greg Kroah-Hartman
2021-04-23 4:22 ` Jiri Slaby
2021-04-23 9:55 ` Samo Pogačnik
2021-04-23 10:12 ` Tetsuo Handa
2021-04-23 19:47 ` Samo Pogačnik
2021-04-24 1:16 ` Tetsuo Handa
2021-04-24 9:57 ` Samo Pogačnik
2021-04-26 10:00 ` Petr Mladek
2021-04-26 16:42 ` Samo Pogačnik
2021-04-27 10:08 ` Petr Mladek
2021-04-27 11:31 ` Samo Pogačnik
2021-04-23 10:28 ` Jiri Slaby
2021-04-23 12:23 ` [PATCH] ttyprintk: Add TTY port shutdown callback Samo Pogačnik
2021-04-12 12:41 ` How to handle concurrent access to /dev/ttyprintk ? Samo Pogačnik
2021-04-13 9:41 ` Petr Mladek
2021-04-13 11:10 ` Samo Pogačnik
2021-04-13 14:32 ` Petr Mladek
2021-04-13 15:22 ` Samo Pogačnik
2021-04-14 17:36 ` Petr Mladek
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=17e0652d-89b7-c8c0-fb53-e7566ac9add4@i-love.sakura.ne.jp \
--to=penguin-kernel@i-love.sakura.ne.jp \
--cc=gregkh@linuxfoundation.org \
--cc=jirislaby@kernel.org \
--cc=john.ogness@linutronix.de \
--cc=linux-kernel@vger.kernel.org \
--cc=pmladek@suse.com \
--cc=rostedt@goodmis.org \
--cc=samo_pogacnik@t-2.net \
--cc=sergey.senozhatsky@gmail.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).