Skip to contentSkip to conversation

tty: tty_port: restore TTY_IO_ERROR on activation failure

PATCH New Johan Hovold 2 participants 2 messages Sep 8

Subsystems (2)
Stable branch TTY layer and serial drivers
lore
Share & tools
lore

Johan Hovold

author
#0 lore raw

PATCH 1/1 tty: tty_port: restore TTY_IO_ERROR on activation failure

Make sure to restore the TTY_IO_ERROR flag if activation fails to prevent I/O attempts on a port that is gone or powered down.

This specifically avoids issues like kernel panic due to unclocked accesses or NULL-pointer dereferences when accessing powered down or deregistered ports when a TTY ioctl races with hangup and open.

Note that the flag is set again in tty_port_close() but not restoring it on activation failure leaves a window where drivers fail to handle the ioctl-hangup race.

Fixes a9a37ec33a1b ("tty: tty_port: Move the IO_ERROR clear")
Cc [email protected] # 2.6.33
Signed-off-by Johan Hovold <[email protected]>
---
 drivers/tty/tty_port.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/tty/tty_port.c +3 -1
index 54359310e293..ae33987207b6 100644
@@ -767,8 +767,10 @@ int tty_port_open(struct tty_port *port, struct tty_struct *tty,
 		clear_bit(TTY_IO_ERROR, &tty->flags);
 		if (port->ops->activate) {
 			int retval = port->ops->activate(port, tty);
-			if (retval)
+			if (retval) {
+				set_bit(TTY_IO_ERROR, &tty->flags);
 				return retval;
+			}
 		}
 		tty_port_set_initialized(port, true);
 	}
Signature · 1 line
2.55.0
AI review
#1 lore raw
Sashiko has reviewed this patch and found no issues. It looks great!
Quoted 7 lines

Make sure to restore the TTY_IO_ERROR flag if activation fails to prevent I/O attempts on a port that is gone or powered down.

This specifically avoids issues like kernel panic due to unclocked accesses or NULL-pointer dereferences when accessing powered down or deregistered ports when a TTY ioctl races with hangup and open.

Quoted 7 lines

Note that the flag is set again in tty_port_close() but not restoring it on activation failure leaves a window where drivers fail to handle the ioctl-hangup race.

Fixes a9a37ec33a1b ("tty: tty_port: Move the IO_ERROR clear")
Cc [email protected] # 2.6.33
Signed-off-by Johan Hovold <[email protected]>

Sashiko has reviewed this patch and found no issues. It looks great!

Signature · 1 line
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1