Commit e2bd1dcb authored by Raghavendra Rao Ananta's avatar Raghavendra Rao Ananta Committed by Greg Kroah-Hartman

tty: hvc: Fix data abort due to race in hvc_open

Potentially, hvc_open() can be called in parallel when two tasks calls
open() on /dev/hvcX. In such a scenario, if the hp->ops->notifier_add()
callback in the function fails, where it sets the tty->driver_data to
NULL, the parallel hvc_open() can see this NULL and cause a memory abort.
Hence, serialize hvc_open and check if tty->private_data is NULL before
proceeding ahead.

The issue can be easily reproduced by launching two tasks simultaneously
that does nothing but open() and close() on /dev/hvcX.
For example:
$ ./simple_open_close /dev/hvc0 & ./simple_open_close /dev/hvc0 &
Signed-off-by: default avatarRaghavendra Rao Ananta <rananta@codeaurora.org>
Link: https://lore.kernel.org/r/20200428032601.22127-1-rananta@codeaurora.orgSigned-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent ff62255a
...@@ -75,6 +75,8 @@ static LIST_HEAD(hvc_structs); ...@@ -75,6 +75,8 @@ static LIST_HEAD(hvc_structs);
*/ */
static DEFINE_MUTEX(hvc_structs_mutex); static DEFINE_MUTEX(hvc_structs_mutex);
/* Mutex to serialize hvc_open */
static DEFINE_MUTEX(hvc_open_mutex);
/* /*
* This value is used to assign a tty->index value to a hvc_struct based * This value is used to assign a tty->index value to a hvc_struct based
* upon order of exposure via hvc_probe(), when we can not match it to * upon order of exposure via hvc_probe(), when we can not match it to
...@@ -346,16 +348,24 @@ static int hvc_install(struct tty_driver *driver, struct tty_struct *tty) ...@@ -346,16 +348,24 @@ static int hvc_install(struct tty_driver *driver, struct tty_struct *tty)
*/ */
static int hvc_open(struct tty_struct *tty, struct file * filp) static int hvc_open(struct tty_struct *tty, struct file * filp)
{ {
struct hvc_struct *hp = tty->driver_data; struct hvc_struct *hp;
unsigned long flags; unsigned long flags;
int rc = 0; int rc = 0;
mutex_lock(&hvc_open_mutex);
hp = tty->driver_data;
if (!hp) {
rc = -EIO;
goto out;
}
spin_lock_irqsave(&hp->port.lock, flags); spin_lock_irqsave(&hp->port.lock, flags);
/* Check and then increment for fast path open. */ /* Check and then increment for fast path open. */
if (hp->port.count++ > 0) { if (hp->port.count++ > 0) {
spin_unlock_irqrestore(&hp->port.lock, flags); spin_unlock_irqrestore(&hp->port.lock, flags);
hvc_kick(); hvc_kick();
return 0; goto out;
} /* else count == 0 */ } /* else count == 0 */
spin_unlock_irqrestore(&hp->port.lock, flags); spin_unlock_irqrestore(&hp->port.lock, flags);
...@@ -384,6 +394,8 @@ static int hvc_open(struct tty_struct *tty, struct file * filp) ...@@ -384,6 +394,8 @@ static int hvc_open(struct tty_struct *tty, struct file * filp)
/* Force wakeup of the polling thread */ /* Force wakeup of the polling thread */
hvc_kick(); hvc_kick();
out:
mutex_unlock(&hvc_open_mutex);
return rc; return rc;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment