RE: [PATCH 4/4] tty: n_gsm: fix missing corner cases in gsmld_poll()

RE: [PATCH 4/4] tty: n_gsm: fix missing corner cases in gsmld_poll()

[Starke, Daniel]

> > @@ -3051,14 +3051,20 @@ static __poll_t gsmld_poll(struct tty_struct *tty, struct file *file,
> >   	__poll_t mask = 0;
> >   	struct gsm_mux *gsm = tty->disc_data;
> >   
> > +	if (!gsm)
> > +		return EPOLLHUP;
> 
> Hmm, how can this happen? It's a tty bug if it calls ld ops after NULLing
> disc_data.

I can remove this check if it is redundant. Should I?

Best regards,
Daniel Starke

Re: [PATCH 4/4] tty: n_gsm: fix missing corner cases in gsmld_poll()

[Jiri Slaby]

On 07. 07. 22, 9:00, Starke, Daniel wrote:
>>> @@ -3051,14 +3051,20 @@ static __poll_t gsmld_poll(struct tty_struct *tty, struct file *file,
>>>    	__poll_t mask = 0;
>>>    	struct gsm_mux *gsm = tty->disc_data;
>>>    
>>> +	if (!gsm)
>>> +		return EPOLLHUP;
>>
>> Hmm, how can this happen? It's a tty bug if it calls ld ops after NULLing
>> disc_data.
> 
> I can remove this check if it is redundant. Should I?

Sure as it makes little sense anyway. Even if gsm was non-NULL here, the 
backing disc_data would be freed on the accesses further.

thanks,
-- 
js
suse labs

Re: [PATCH 4/4] tty: n_gsm: fix missing corner cases in gsmld_poll()

[Jiri Slaby]

On 06. 07. 22, 7:44, D. Starke wrote:
> From: Daniel Starke <daniel.starke@siemens.com>
> 
> gsmld_poll() currently fails to handle some corner cases correctly:
> - tty ldisc association lost
> - remote party closed the associated tty
> 
> Add the missing checks and map those to EPOLLHUP.
> Reorder the checks to group them by their reaction.
> 
> Fixes: e1eaea46bb40 ("tty: n_gsm line discipline")
> Signed-off-by: Daniel Starke <daniel.starke@siemens.com>
> ---
>   drivers/tty/n_gsm.c | 10 ++++++++--
>   1 file changed, 8 insertions(+), 2 deletions(-)
> 
> Based on tty-testing.
> 
> diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
> index 51447ccccbab..47566bd2ed6e 100644
> --- a/drivers/tty/n_gsm.c
> +++ b/drivers/tty/n_gsm.c
> @@ -3051,14 +3051,20 @@ static __poll_t gsmld_poll(struct tty_struct *tty, struct file *file,
>   	__poll_t mask = 0;
>   	struct gsm_mux *gsm = tty->disc_data;
>   
> +	if (!gsm)
> +		return EPOLLHUP;

Hmm, how can this happen? It's a tty bug if it calls ld ops after 
NULLing disc_data.

thanks,
-- 
js
suse labs