From: Richard Genoud <richard.genoud@gmail.com> To: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Cc: Rob Herring <robh@kernel.org>, Alexandre Belloni <alexandre.belloni@bootlin.com>, Peter Hurley <peter@hurleysoftware.com>, Greg Kroah-Hartman <gregkh@linuxfoundation.org>, linux-serial@vger.kernel.org, Jiri Slaby <jslaby@suse.com>, tglx@linutronix.de, linux-arm-kernel@lists.infradead.org Subject: Re: [PATCH v2] tty/serial: atmel: use port->name as name in request_irq() Date: Fri, 4 May 2018 12:28:56 +0200 [thread overview] Message-ID: <d62a945c-f81e-d7e5-8431-a7948a0b833c@sorico.fr> (raw) In-Reply-To: <20180504081447.enontsm6jod4xa6g@linutronix.de> On 04/05/2018 10:14, Sebastian Andrzej Siewior wrote: > I was puzzled while looking at /proc/interrupts and random things showed > up between reboots. This occurred more often but I realised it later. The > "correct" output should be: > |38: 11861 atmel-aic5 2 Level ttyS0 > > but I saw sometimes > |38: 6426 atmel-aic5 2 Level tty1 > > and accounted it wrongly as correct. This is use after free and the > former example randomly got the "old" pointer which pointed to the same > content. With SLAB_FREELIST_RANDOM and HARDENED I even got > |38: 7067 atmel-aic5 2 Level E=Started User Manager for UID 0 > > or other nonsense. > As it turns out the tty, pointer that is accessed in atmel_startup(), is > freed() before atmel_shutdown(). It seems to happen quite often that the > tty for ttyS0 is allocated and freed while ->shutdown is not invoked. I > don't do anything special - just a systemd boot :) > > Use port->name as the IRQ name for request_irq(). This exists as long as > the driver is loaded so no use-after-free here. > For backports before v4.12 I suggest to use `"atmel_serial"' instead > `port->name' (that member was introduced in f7048b15900f ("tty: serial_core: > Add name field to uart_port struct"). > > Cc: stable@vger.kernel.org I think it's safer to use: Cc: stable@vger.kernel.org # 4.14 Because the stable team may miss your comment, and even if they don't, I think it's not their role to adapt the patch to 4.9.x (and test it !) IMHO, the best way is to add # 4.14 and when it's applied on 4.14.x, send a tested backport for 4.9.x Besides that, you can add my: Acked-by: Richard Genoud <richard.genoud@gmail.com> Rob, do you agree with this fix ? > Fixes: 761ed4a94582 ("tty: serial_core: convert uart_close to use tty_port_close") > Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> > --- > v1…v2: - Bisected and added a Fixes tag > - added a note for backporters to v4.9 … v4.12 (pointed out by > Richard Genoud) > > drivers/tty/serial/atmel_serial.c | 4 +--- > 1 file changed, 1 insertion(+), 3 deletions(-) > > diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c > index e287fe8f10fc..d3189816740e 100644 > --- a/drivers/tty/serial/atmel_serial.c > +++ b/drivers/tty/serial/atmel_serial.c > @@ -1757,7 +1757,6 @@ static int atmel_startup(struct uart_port *port) > { > struct platform_device *pdev = to_platform_device(port->dev); > struct atmel_uart_port *atmel_port = to_atmel_uart_port(port); > - struct tty_struct *tty = port->state->port.tty; > int retval; > > /* > @@ -1772,8 +1771,7 @@ static int atmel_startup(struct uart_port *port) > * Allocate the IRQ > */ > retval = request_irq(port->irq, atmel_interrupt, > - IRQF_SHARED | IRQF_COND_SUSPEND, > - tty ? tty->name : "atmel_serial", port); > + IRQF_SHARED | IRQF_COND_SUSPEND, port->name, port); > if (retval) { > dev_err(port->dev, "atmel_startup - Can't get irq\n"); > return retval; > Thanks ! _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
WARNING: multiple messages have this Message-ID (diff)
From: richard.genoud@gmail.com (Richard Genoud) To: linux-arm-kernel@lists.infradead.org Subject: [PATCH v2] tty/serial: atmel: use port->name as name in request_irq() Date: Fri, 4 May 2018 12:28:56 +0200 [thread overview] Message-ID: <d62a945c-f81e-d7e5-8431-a7948a0b833c@sorico.fr> (raw) In-Reply-To: <20180504081447.enontsm6jod4xa6g@linutronix.de> On 04/05/2018 10:14, Sebastian Andrzej Siewior wrote: > I was puzzled while looking at /proc/interrupts and random things showed > up between reboots. This occurred more often but I realised it later. The > "correct" output should be: > |38: 11861 atmel-aic5 2 Level ttyS0 > > but I saw sometimes > |38: 6426 atmel-aic5 2 Level tty1 > > and accounted it wrongly as correct. This is use after free and the > former example randomly got the "old" pointer which pointed to the same > content. With SLAB_FREELIST_RANDOM and HARDENED I even got > |38: 7067 atmel-aic5 2 Level E=Started User Manager for UID 0 > > or other nonsense. > As it turns out the tty, pointer that is accessed in atmel_startup(), is > freed() before atmel_shutdown(). It seems to happen quite often that the > tty for ttyS0 is allocated and freed while ->shutdown is not invoked. I > don't do anything special - just a systemd boot :) > > Use port->name as the IRQ name for request_irq(). This exists as long as > the driver is loaded so no use-after-free here. > For backports before v4.12 I suggest to use `"atmel_serial"' instead > `port->name' (that member was introduced in f7048b15900f ("tty: serial_core: > Add name field to uart_port struct"). > > Cc: stable at vger.kernel.org I think it's safer to use: Cc: stable at vger.kernel.org # 4.14 Because the stable team may miss your comment, and even if they don't, I think it's not their role to adapt the patch to 4.9.x (and test it !) IMHO, the best way is to add # 4.14 and when it's applied on 4.14.x, send a tested backport for 4.9.x Besides that, you can add my: Acked-by: Richard Genoud <richard.genoud@gmail.com> Rob, do you agree with this fix ? > Fixes: 761ed4a94582 ("tty: serial_core: convert uart_close to use tty_port_close") > Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> > --- > v1?v2: - Bisected and added a Fixes tag > - added a note for backporters to v4.9 ? v4.12 (pointed out by > Richard Genoud) > > drivers/tty/serial/atmel_serial.c | 4 +--- > 1 file changed, 1 insertion(+), 3 deletions(-) > > diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c > index e287fe8f10fc..d3189816740e 100644 > --- a/drivers/tty/serial/atmel_serial.c > +++ b/drivers/tty/serial/atmel_serial.c > @@ -1757,7 +1757,6 @@ static int atmel_startup(struct uart_port *port) > { > struct platform_device *pdev = to_platform_device(port->dev); > struct atmel_uart_port *atmel_port = to_atmel_uart_port(port); > - struct tty_struct *tty = port->state->port.tty; > int retval; > > /* > @@ -1772,8 +1771,7 @@ static int atmel_startup(struct uart_port *port) > * Allocate the IRQ > */ > retval = request_irq(port->irq, atmel_interrupt, > - IRQF_SHARED | IRQF_COND_SUSPEND, > - tty ? tty->name : "atmel_serial", port); > + IRQF_SHARED | IRQF_COND_SUSPEND, port->name, port); > if (retval) { > dev_err(port->dev, "atmel_startup - Can't get irq\n"); > return retval; > Thanks !
next prev parent reply other threads:[~2018-05-04 10:28 UTC|newest] Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top 2018-04-26 15:06 [PATCH] tty/serial: atmel: use port->name as name in request_irq() Sebastian Andrzej Siewior 2018-04-26 15:06 ` Sebastian Andrzej Siewior 2018-04-26 15:12 ` Sebastian Andrzej Siewior 2018-04-26 15:12 ` Sebastian Andrzej Siewior 2018-04-27 10:31 ` Richard Genoud 2018-04-27 10:31 ` Richard Genoud 2018-05-02 19:16 ` Sebastian Andrzej Siewior 2018-05-02 19:16 ` Sebastian Andrzej Siewior 2018-05-03 12:36 ` Richard Genoud 2018-05-03 12:36 ` Richard Genoud 2018-05-03 12:44 ` Sebastian Andrzej Siewior 2018-05-03 12:44 ` Sebastian Andrzej Siewior 2018-05-03 13:34 ` Richard Genoud 2018-05-03 13:34 ` Richard Genoud 2018-05-03 15:12 ` Richard Genoud 2018-05-03 15:12 ` Richard Genoud 2018-05-04 6:35 ` Richard Genoud 2018-05-04 6:35 ` Richard Genoud 2018-05-04 8:14 ` [PATCH v2] " Sebastian Andrzej Siewior 2018-05-04 8:14 ` Sebastian Andrzej Siewior 2018-05-04 10:28 ` Richard Genoud [this message] 2018-05-04 10:28 ` Richard Genoud 2018-05-04 20:23 ` Rob Herring 2018-05-04 20:23 ` Rob Herring 2018-05-07 17:11 ` [PATCH v3] " Sebastian Andrzej Siewior 2018-05-07 17:11 ` Sebastian Andrzej Siewior
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=d62a945c-f81e-d7e5-8431-a7948a0b833c@sorico.fr \ --to=richard.genoud@gmail.com \ --cc=alexandre.belloni@bootlin.com \ --cc=bigeasy@linutronix.de \ --cc=gregkh@linuxfoundation.org \ --cc=jslaby@suse.com \ --cc=linux-arm-kernel@lists.infradead.org \ --cc=linux-serial@vger.kernel.org \ --cc=peter@hurleysoftware.com \ --cc=robh@kernel.org \ --cc=tglx@linutronix.de \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.