All of lore.kernel.org
 help / color / mirror / Atom feed
From: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
To: "Samo Pogačnik" <samo_pogacnik@t-2.net>,
	"Greg Kroah-Hartman" <gregkh@linuxfoundation.org>,
	"Jiri Slaby" <jirislaby@kernel.org>
Cc: Petr Mladek <pmladek@suse.com>,
	Sergey Senozhatsky <sergey.senozhatsky@gmail.com>,
	Steven Rostedt <rostedt@goodmis.org>,
	John Ogness <john.ogness@linutronix.de>,
	linux-kernel@vger.kernel.org,
	syzkaller-bugs <syzkaller-bugs@googlegroups.com>
Subject: [PATCH] ttyprintk: Add TTY hangup callback.
Date: Thu, 15 Apr 2021 09:22:22 +0900	[thread overview]
Message-ID: <17e0652d-89b7-c8c0-fb53-e7566ac9add4@i-love.sakura.ne.jp> (raw)
In-Reply-To: <31a4dec3d36ed131402244693cae180816ebd4d7.camel@t-2.net>

syzbot is reporting hung task due to flood of

  tty_warn(tty, "%s: tty->count = 1 port count = %d\n", __func__,
           port->count);

message [1], for ioctl(TIOCVHANGUP) prevents tty_port_close() from
decrementing port->count due to tty_hung_up_p() == true.

----------
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#include <unistd.h>

int main(int argc, char *argv[])
{
	int i;
	int fd[10];

	for (i = 0; i < 10; i++)
		fd[i] = open("/dev/ttyprintk", O_WRONLY);
	ioctl(fd[0], TIOCVHANGUP);
	for (i = 0; i < 10; i++)
		close(fd[i]);
	close(open("/dev/ttyprintk", O_WRONLY));
	return 0;
}
----------

When TTY hangup happens, port->count needs to be reset via
"struct tty_operations"->hangup callback.

[1] https://syzkaller.appspot.com/bug?id=39ea6caa479af471183997376dc7e90bc7d64a6a

Reported-by: syzbot <syzbot+43e93968b964e369db0b@syzkaller.appspotmail.com>
Reported-by: syzbot <syzbot+3ed715090790806d8b18@syzkaller.appspotmail.com>
Tested-by: syzbot <syzbot+43e93968b964e369db0b@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Fixes: 24b4b67d17c308aa ("add ttyprintk driver")
---
 drivers/char/ttyprintk.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/char/ttyprintk.c b/drivers/char/ttyprintk.c
index 6a0059e508e3..93f5d11c830b 100644
--- a/drivers/char/ttyprintk.c
+++ b/drivers/char/ttyprintk.c
@@ -158,12 +158,23 @@ static int tpk_ioctl(struct tty_struct *tty,
 	return 0;
 }
 
+/*
+ * TTY operations hangup function.
+ */
+static void tpk_hangup(struct tty_struct *tty)
+{
+	struct ttyprintk_port *tpkp = tty->driver_data;
+
+	tty_port_hangup(&tpkp->port);
+}
+
 static const struct tty_operations ttyprintk_ops = {
 	.open = tpk_open,
 	.close = tpk_close,
 	.write = tpk_write,
 	.write_room = tpk_write_room,
 	.ioctl = tpk_ioctl,
+	.hangup = tpk_hangup,
 };
 
 static const struct tty_port_operations null_ops = { };
-- 
2.18.4



  reply	other threads:[~2021-04-15  0:22 UTC|newest]

Thread overview: 45+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-04-03  4:14 [PATCH] tty: use printk_safe context at tty_msg() Tetsuo Handa
2021-04-03  6:52 ` kernel test robot
2021-04-03  6:52   ` kernel test robot
2021-04-03 10:11   ` [PATCH] printk: Make multiple inclusion of kernel/printk/internal.h safe Tetsuo Handa
2021-04-03 10:11     ` Tetsuo Handa
2021-04-06  4:51 ` [PATCH] tty: use printk_safe context at tty_msg() Jiri Slaby
2021-04-06  5:31   ` Tetsuo Handa
2021-04-06  7:10     ` Greg Kroah-Hartman
2021-04-06 11:16       ` Tetsuo Handa
2021-04-06 13:42         ` Greg Kroah-Hartman
2021-04-06 15:10 ` Petr Mladek
2021-04-06 16:22   ` Tetsuo Handa
2021-04-06 19:10     ` Greg Kroah-Hartman
2021-04-07  9:20       ` Petr Mladek
2021-04-07 13:26     ` [PATCH v2] tty: use printk_deferred() " Tetsuo Handa
2021-04-07 13:48       ` Greg Kroah-Hartman
2021-04-07 14:24         ` Tetsuo Handa
2021-04-12 10:39           ` How to handle concurrent access to /dev/ttyprintk ? Tetsuo Handa
2021-04-12 10:44             ` Greg Kroah-Hartman
2021-04-12 11:25               ` Tetsuo Handa
2021-04-12 12:04                 ` Greg Kroah-Hartman
2021-04-14  0:45                   ` Tetsuo Handa
2021-04-14 11:11                     ` Tetsuo Handa
2021-04-14 16:15                       ` Samo Pogačnik
2021-04-15  0:22                         ` Tetsuo Handa [this message]
2021-04-18 11:16                           ` [PATCH] ttyprintk: Add TTY hangup callback Samo Pogačnik
2021-04-22 10:02                             ` Greg Kroah-Hartman
2021-04-23  4:22                             ` Jiri Slaby
2021-04-23  9:55                               ` Samo Pogačnik
2021-04-23 10:12                                 ` Tetsuo Handa
2021-04-23 19:47                                   ` Samo Pogačnik
2021-04-24  1:16                                     ` Tetsuo Handa
2021-04-24  9:57                                       ` Samo Pogačnik
2021-04-26 10:00                                         ` Petr Mladek
2021-04-26 16:42                                           ` Samo Pogačnik
2021-04-27 10:08                                             ` Petr Mladek
2021-04-27 11:31                                               ` Samo Pogačnik
2021-04-23 10:28                                 ` Jiri Slaby
2021-04-23 12:23                                   ` [PATCH] ttyprintk: Add TTY port shutdown callback Samo Pogačnik
2021-04-12 12:41             ` How to handle concurrent access to /dev/ttyprintk ? Samo Pogačnik
2021-04-13  9:41               ` Petr Mladek
2021-04-13 11:10                 ` Samo Pogačnik
2021-04-13 14:32                   ` Petr Mladek
2021-04-13 15:22                     ` Samo Pogačnik
2021-04-14 17:36                       ` Petr Mladek

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=17e0652d-89b7-c8c0-fb53-e7566ac9add4@i-love.sakura.ne.jp \
    --to=penguin-kernel@i-love.sakura.ne.jp \
    --cc=gregkh@linuxfoundation.org \
    --cc=jirislaby@kernel.org \
    --cc=john.ogness@linutronix.de \
    --cc=linux-kernel@vger.kernel.org \
    --cc=pmladek@suse.com \
    --cc=rostedt@goodmis.org \
    --cc=samo_pogacnik@t-2.net \
    --cc=sergey.senozhatsky@gmail.com \
    --cc=syzkaller-bugs@googlegroups.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.