From: Peter Hurley <peter@hurleysoftware.com>
To: Ben Hutchings <ben@decadent.org.uk>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Jiri Slaby <jslaby@suse.cz>,
linux-kernel@vger.kernel.org, stable@vger.kernel.org
Subject: Re: [PATCH v2 09/19] staging/speakup: Use tty_ldisc_ref() for paste kworker
Date: Sun, 10 Jan 2016 16:25:17 -0800 [thread overview]
Message-ID: <5692F66D.8060207@hurleysoftware.com> (raw)
In-Reply-To: <1452467777.2435.66.camel@decadent.org.uk>
On 01/10/2016 03:16 PM, Ben Hutchings wrote:
> On Sat, 2016-01-09 at 20:41 -0800, Peter Hurley wrote:
>> As the function documentation for tty_ldisc_ref_wait() notes, it is
>> only callable from a tty file_operations routine; otherwise there
>> is no guarantee the ref won't be NULL.
>>
>> The key difference with the VT's paste_selection() is that is an ioctl,
>> where __speakup_paste_selection() is completely asynch kworker, kicked
>> off from interrupt context.
>>
>> Fixes: 28a821c30688 ("Staging: speakup: Update __speakup_paste_selection()
>> tty (ab)usage to match vt")
>> Cc: <stable@vger.kernel.org>
>>
>> Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
>> ---
>> drivers/staging/speakup/selection.c | 4 +++-
>> 1 file changed, 3 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/staging/speakup/selection.c b/drivers/staging/speakup/selection.c
>> index aa5ab6c..86c0b9a 100644
>> --- a/drivers/staging/speakup/selection.c
>> +++ b/drivers/staging/speakup/selection.c
>> @@ -142,7 +142,9 @@ static void __speakup_paste_selection(struct work_struct *work)
>> struct tty_ldisc *ld;
>> DECLARE_WAITQUEUE(wait, current);
>>
>> - ld = tty_ldisc_ref_wait(tty);
>> + ld = tty_ldisc_ref(tty);
>> + if (!ld)
>> + return;
>> tty_buffer_lock_exclusive(&vc->port);
>>
>> add_wait_queue(&vc->paste_wait, &wait);
>
> This leaks a reference to the tty. Instead of returning directly, I
> think you need to add a label and goto the tty_kref_put() at the bottom
> of the function.
Ugh, speakup_paste_selection() is a worse hack than I thought it was.
next prev parent reply other threads:[~2016-01-11 0:25 UTC|newest]
Thread overview: 71+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-11-27 21:38 [PATCH 00/19] Fix driver crashes on hangup Peter Hurley
2015-11-27 21:38 ` [PATCH 01/19] staging: digi: Replace open-coded tty_wakeup() Peter Hurley
2015-11-27 21:38 ` [PATCH 02/19] serial: 68328: Remove bogus ldisc reset Peter Hurley
2015-11-27 21:39 ` [PATCH 03/19] bluetooth: hci_ldisc: Remove dead code Peter Hurley
2015-12-02 7:47 ` Marcel Holtmann
2015-11-27 21:39 ` [PATCH 04/19] NFC: nci: " Peter Hurley
2015-11-27 21:39 ` [PATCH 05/19] tty: Remove chars_in_buffer() line discipline method Peter Hurley
2015-11-27 21:39 ` [PATCH 06/19] tty: Fix unsafe ldisc reference via ioctl(TIOCGETD) Peter Hurley
2015-11-27 21:39 ` [PATCH 07/19] n_tty: Fix unsafe reference to "other" ldisc Peter Hurley
2015-11-27 21:39 ` [PATCH 08/19] tty: Reset c_line from driver's init_termios Peter Hurley
2015-11-27 21:39 ` [PATCH 09/19] staging/speakup: Use tty_ldisc_ref() for paste kworker Peter Hurley
2015-11-27 21:39 ` [PATCH 10/19] tty: Fix comments for tty_ldisc_get() Peter Hurley
2015-11-27 21:39 ` [PATCH 11/19] tty: Fix comments for tty_ldisc_release() Peter Hurley
2015-11-27 21:39 ` [PATCH 12/19] tty: Prepare for destroying line discipline on hangup Peter Hurley
2015-11-27 21:39 ` [PATCH 13/19] tty: Handle NULL tty->ldisc Peter Hurley
2015-11-27 21:39 ` [PATCH 14/19] tty: Move tty_ldisc_kill() Peter Hurley
2015-11-27 21:39 ` [PATCH 15/19] tty: Use 'disc' for line discipline index name Peter Hurley
2015-11-27 21:39 ` [PATCH 16/19] tty: Refactor tty_ldisc_reinit() for reuse Peter Hurley
2015-11-27 21:39 ` [PATCH 17/19] tty: Destroy ldisc instance on hangup Peter Hurley
2015-11-27 21:39 ` [PATCH 18/19] tty: Document c_line == N_TTY initial condition Peter Hurley
2015-11-27 21:39 ` [PATCH 19/19] tty: Touch up style issues in ldisc core Peter Hurley
2016-01-10 4:40 ` [PATCH v2 00/19] Fix driver crashes on hangup Peter Hurley
2016-01-10 4:40 ` [PATCH v2 01/19] staging: digi: Replace open-coded tty_wakeup() Peter Hurley
2016-01-10 4:40 ` [PATCH v2 02/19] serial: 68328: Remove bogus ldisc reset Peter Hurley
2016-01-10 4:40 ` [PATCH v2 03/19] bluetooth: hci_ldisc: Remove dead code Peter Hurley
2016-01-10 4:40 ` [PATCH v2 04/19] NFC: nci: " Peter Hurley
2016-01-10 4:40 ` [PATCH v2 05/19] tty: Remove chars_in_buffer() line discipline method Peter Hurley
2016-01-10 4:40 ` [PATCH v2 06/19] tty: Fix unsafe ldisc reference via ioctl(TIOCGETD) Peter Hurley
2016-01-10 5:24 ` Peter Hurley
2016-01-10 4:40 ` [PATCH v2 07/19] n_tty: Fix unsafe reference to "other" ldisc Peter Hurley
2016-01-10 5:26 ` Peter Hurley
2016-01-10 4:40 ` [PATCH v2 08/19] tty: Reset c_line from driver's init_termios Peter Hurley
2016-01-10 4:41 ` [PATCH v2 09/19] staging/speakup: Use tty_ldisc_ref() for paste kworker Peter Hurley
2016-01-10 23:16 ` Ben Hutchings
2016-01-11 0:25 ` Peter Hurley [this message]
2016-01-11 5:40 ` Peter Hurley
2016-01-11 10:37 ` Ben Hutchings
2016-01-10 4:41 ` [PATCH v2 10/19] tty: Fix comments for tty_ldisc_get() Peter Hurley
2016-01-10 4:41 ` [PATCH v2 11/19] tty: Fix comments for tty_ldisc_release() Peter Hurley
2016-01-10 4:41 ` [PATCH v2 12/19] tty: Prepare for destroying line discipline on hangup Peter Hurley
2016-01-10 4:41 ` [PATCH v2 13/19] tty: Handle NULL tty->ldisc Peter Hurley
2016-01-10 4:41 ` [PATCH v2 14/19] tty: Move tty_ldisc_kill() Peter Hurley
2016-01-10 4:41 ` [PATCH v2 15/19] tty: Use 'disc' for line discipline index name Peter Hurley
2016-01-10 4:41 ` [PATCH v2 16/19] tty: Refactor tty_ldisc_reinit() for reuse Peter Hurley
2016-01-10 4:41 ` [PATCH v2 17/19] tty: Destroy ldisc instance on hangup Peter Hurley
2016-01-10 6:24 ` kbuild test robot
2016-01-10 6:24 ` [PATCH] tty: fix badzero.cocci warnings kbuild test robot
2016-01-10 7:02 ` Peter Hurley
2016-01-10 4:41 ` [PATCH v2 18/19] tty: Document c_line == N_TTY initial condition Peter Hurley
2016-01-10 4:41 ` [PATCH v2 19/19] tty: Avoid unnecessary temporaries for tty->ldisc Peter Hurley
2016-01-11 6:40 ` [PATCH v3 00/19] Fix driver crashes on hangup Peter Hurley
2016-01-11 6:40 ` [PATCH v3 01/19] staging: digi: Replace open-coded tty_wakeup() Peter Hurley
2016-01-11 6:40 ` [PATCH v3 02/19] serial: 68328: Remove bogus ldisc reset Peter Hurley
2016-01-11 14:12 ` One Thousand Gnomes
2016-01-11 6:40 ` [PATCH v3 03/19] bluetooth: hci_ldisc: Remove dead code Peter Hurley
2016-01-11 6:40 ` [PATCH v3 04/19] NFC: nci: " Peter Hurley
2016-01-11 6:40 ` [PATCH v3 05/19] tty: Remove chars_in_buffer() line discipline method Peter Hurley
2016-01-11 6:40 ` [PATCH v3 06/19] tty: Fix unsafe ldisc reference via ioctl(TIOCGETD) Peter Hurley
2016-01-11 6:40 ` [PATCH v3 07/19] n_tty: Fix unsafe reference to "other" ldisc Peter Hurley
2016-01-11 6:40 ` [PATCH v3 08/19] tty: Reset c_line from driver's init_termios Peter Hurley
2016-01-11 6:40 ` [PATCH v3 09/19] staging/speakup: Use tty_ldisc_ref() for paste kworker Peter Hurley
2016-01-11 6:40 ` [PATCH v3 10/19] tty: Fix comments for tty_ldisc_get() Peter Hurley
2016-01-11 6:41 ` [PATCH v3 11/19] tty: Fix comments for tty_ldisc_release() Peter Hurley
2016-01-11 6:41 ` [PATCH v3 12/19] tty: Prepare for destroying line discipline on hangup Peter Hurley
2016-01-11 6:41 ` [PATCH v3 13/19] tty: Handle NULL tty->ldisc Peter Hurley
2016-01-11 6:41 ` [PATCH v3 14/19] tty: Move tty_ldisc_kill() Peter Hurley
2016-01-11 6:41 ` [PATCH v3 15/19] tty: Use 'disc' for line discipline index name Peter Hurley
2016-01-11 6:41 ` [PATCH v3 16/19] tty: Refactor tty_ldisc_reinit() for reuse Peter Hurley
2016-01-11 6:41 ` [PATCH v3 17/19] tty: Destroy ldisc instance on hangup Peter Hurley
2016-01-11 6:41 ` [PATCH v3 18/19] tty: Document c_line == N_TTY initial condition Peter Hurley
2016-01-11 6:41 ` [PATCH v3 19/19] tty: Avoid unnecessary temporaries for tty->ldisc Peter Hurley
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5692F66D.8060207@hurleysoftware.com \
--to=peter@hurleysoftware.com \
--cc=ben@decadent.org.uk \
--cc=gregkh@linuxfoundation.org \
--cc=jslaby@suse.cz \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).