CAIF device

CAIF device

[Alan]

I was reading through the CAIF code and I noticed a couple of bugs

Doesn't check there is a write method so set on a read only
device it's not good news (doubly so as there seem to be no
permission checks ?) plus no permissions checks and also the
following which looks unsafe

        dev_close(ser->dev);
        unregister_netdevice(ser->dev);
        list_del(&ser->node);
        debugfs_deinit(ser);

Now ser is the netdev private data so what stops it going away when
unregister_netdev is called ?

Secondly tty devices are ref counted and this for some reason didn't get
fixed in the driver yet.

[Patches to follow for the write and kref bugs, the others need the
authors and someone who knows the netdev code these days to fix]

RE: CAIF device

[Sjur BRENDELAND]

Hi Alan.

Alan wrote:
> I was reading through the CAIF code and I noticed a couple of bugs
> 
> Doesn't check there is a write method so set on a read only
> device it's not good news (doubly so as there seem to be no
> permission checks ?) plus no permissions checks and also the
> following which looks unsafe
> 
>         dev_close(ser->dev);
>         unregister_netdevice(ser->dev);
>         list_del(&ser->node);
>         debugfs_deinit(ser);
> 
> Now ser is the netdev private data so what stops it going away when
> unregister_netdev is called ?

I think this should work fine as the unregistration of the ser->dev is done after rtnl_lock,
this delays the freeing of the device until rtnl_unlock.
> 
> Secondly tty devices are ref counted and this for some reason didn't
> get fixed in the driver yet.
> 
> [Patches to follow for the write and kref bugs, the others need the
> authors and someone who knows the netdev code these days to fix]

Thanks, looking forward to review your patches.

BR/Sjur

[PATCH] Caif: Ref counting

[Alan Cox]

caif: tty's are kref objects so take a reference

From: Alan Cox <alan@linux.intel.com>

I don't think this can be abused in this case but do things properly.

Signed-off-by: Alan Cox <alan@linux.intel.com>
---

 drivers/net/caif/caif_serial.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)


diff --git a/drivers/net/caif/caif_serial.c b/drivers/net/caif/caif_serial.c
index 3502f60..b271aa0 100644
--- a/drivers/net/caif/caif_serial.c
+++ b/drivers/net/caif/caif_serial.c
@@ -315,7 +315,7 @@ static int ldisc_open(struct tty_struct *tty)
 	sprintf(name, "cf%s", tty->name);
 	dev = alloc_netdev(sizeof(*ser), name, caifdev_setup);
 	ser = netdev_priv(dev);
-	ser->tty = tty;
+	ser->tty = tty_kref_get(tty);
 	ser->dev = dev;
 	debugfs_init(ser, tty);
 	tty->receive_room = N_TTY_BUF_SIZE;
@@ -348,6 +348,7 @@ static void ldisc_close(struct tty_struct *tty)
 	unregister_netdevice(ser->dev);
 	list_del(&ser->node);
 	debugfs_deinit(ser);
+	tty_kref_put(ser->tty);
 	if (!islocked)
 		rtnl_unlock();
 }

[PATCH] CAIF: write check

[Alan Cox]

caif: check write operations

From: Alan Cox <alan@linux.intel.com>

write is optional for a tty device. Check that we have a write op rather
than calling NULL.

Signed-off-by: Alan Cox <alan@linux.intel.com>
---

 drivers/net/caif/caif_serial.c |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)


diff --git a/drivers/net/caif/caif_serial.c b/drivers/net/caif/caif_serial.c
index b271aa0..38c0186 100644
--- a/drivers/net/caif/caif_serial.c
+++ b/drivers/net/caif/caif_serial.c
@@ -312,6 +312,10 @@ static int ldisc_open(struct tty_struct *tty)
 	char name[64];
 	int result;
 
+	/* No write no play */
+	if (tty->ops->write == NULL)
+		return -EOPNOTSUPP;
+
 	sprintf(name, "cf%s", tty->name);
 	dev = alloc_netdev(sizeof(*ser), name, caifdev_setup);
 	ser = netdev_priv(dev);

Re: [PATCH] CAIF: write check

[David Miller]

From: Alan Cox <alan@lxorguk.ukuu.org.uk>
Date: Wed, 7 Apr 2010 14:17:03 +0100

> caif: check write operations
> 
> From: Alan Cox <alan@linux.intel.com>
> 
> write is optional for a tty device. Check that we have a write op rather
> than calling NULL.
> 
> Signed-off-by: Alan Cox <alan@linux.intel.com>

Applied, thanks Alan.

Re: [PATCH] Caif: Ref counting

[David Miller]

From: Alan Cox <alan@lxorguk.ukuu.org.uk>
Date: Wed, 7 Apr 2010 14:13:19 +0100

> caif: tty's are kref objects so take a reference
> 
> From: Alan Cox <alan@linux.intel.com>
> 
> I don't think this can be abused in this case but do things properly.
> 
> Signed-off-by: Alan Cox <alan@linux.intel.com>

Also applied, thanks Alan.