linux/drivers/tty/hvc
Jiri Slaby a2f892060f TTY: hvc, fix TTY refcounting
A -next commit "TTY: HVC, use tty from tty_port" switched the driver
to use tty_port helper for tty refcounting. But it omitted to remove
manual tty refcounting from open, close and hangup. So now we are
getting random crashes caused by use-after-free:
Unable to handle kernel paging request for data at address 0xc0000003f9d550
Faulting instruction address: 0xc0000000001b7f40
Oops: Kernel access of bad area, sig: 11 [#1]
...
NIP: c0000000001b7f40 LR: c0000000001b7f14 CTR: c0000000000e04f0
...
NIP [c0000000001b7f40] .__kmalloc+0x70/0x230
LR [c0000000001b7f14] .__kmalloc+0x44/0x230
Call Trace:
[c0000003f68bf930] [c0000003f68bf9b0] 0xc0000003f68bf9b0 (unreliable)
[c0000003f68bf9e0] [c0000000001e5424] .alloc_fdmem+0x24/0x70
[c0000003f68bfa60] [c0000000001e54f8] .alloc_fdtable+0x88/0x130
[c0000003f68bfaf0] [c0000000001e5924] .dup_fd+0x384/0x450
[c0000003f68bfbd0] [c00000000009a310] .copy_process+0x880/0x11d0
[c0000003f68bfcd0] [c00000000009aee0] .do_fork+0x70/0x400
[c0000003f68bfdc0] [c0000000000141c4] .sys_clone+0x54/0x70
[c0000003f68bfe30] [c000000000009aa0] .ppc_clone+0x8/0xc

Fix that by complete removal of tty_kref_get/put in open/close/hangup
paths.

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Reported-and-tested-by: Michael Neuling <mikey@neuling.org>
Cc: Stephen Rothwell <sfr@canb.auug.org.au>
Cc: ppc-dev <linuxppc-dev@lists.ozlabs.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2012-04-13 10:54:43 -07:00
..
hvc_beat.c serial: Kill off NO_IRQ 2012-01-26 17:14:50 -08:00
hvc_bfin_jtag.c hvc: add Blackfin JTAG console support 2011-02-17 11:12:40 -08:00
hvc_console.c TTY: hvc, fix TTY refcounting 2012-04-13 10:54:43 -07:00
hvc_console.h TTY: HVC, use count from tty_port 2012-04-09 11:28:18 -07:00
hvc_dcc.c tty: hvc_dcc: Fix duplicate character inputs 2011-11-15 12:02:13 -08:00
hvc_irq.c TTY: irq: Remove IRQF_DISABLED 2011-09-22 16:08:57 -07:00
hvc_iucv.c Fix common misspellings 2011-03-31 11:26:23 -03:00
hvc_opal.c powerpc: fix building hvc_opal.c 2011-11-06 22:21:18 -08:00
hvc_rtas.c serial: Kill off NO_IRQ 2012-01-26 17:14:50 -08:00
hvc_tile.c
hvc_udbg.c Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc 2012-03-21 18:55:10 -07:00
hvc_vio.c powerpc+sparc/vio: Modernize driver registration 2012-03-28 11:33:24 +11:00
hvc_xen.c hvc_xen: introduce HVC_XEN_FRONTEND 2012-03-13 19:24:31 -04:00
hvcs.c TTY: hvcs, use tty from tty_port 2012-04-09 11:28:21 -07:00
hvsi_lib.c TTY: HVC, use tty from tty_port 2012-04-09 11:28:18 -07:00
hvsi.c TTY: hvsi, use tty from tty_port 2012-04-09 11:28:26 -07:00
Kconfig Features: 2012-03-22 20:16:14 -07:00
Makefile tty: powerpc: remove hvc_iseries 2012-03-09 10:35:17 +11:00