tty: pty: Fix race condition between release_one_tty and pty_write (b9ca5f85) · Commits · 戴 / test

Especially when a linked tty is used such as pty, the linked tty port's buf works have not been cancelled while master tty port's buf work has been cancelled. Since release_one_tty and flush_to_ldisc run in workqueue threads separately, when pty_cleanup happens and link tty port is freed, flush_to_ldisc tries to access freed port and port->itty, eventually it causes a panic. This patch utilizes the magic value with holding the tty_mutex to check if the tty->link is valid. Fixes: ("pty: cancel pty slave port buf's work in tty_release") Signed-off-by:

Sahara <keun-o.park@darkmatter.ae> Cc: stable <stable@vger.kernel.org> Signed-off-by:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drivers/tty/pty.c

+7 −0

Original line number	Diff line number	Diff line
		@@ -116,6 +116,12 @@ static int pty_write(struct tty_struct tty, const unsigned char buf, int c)
		if (tty->stopped)
		return 0;

		mutex_lock(&tty_mutex);
		if (to->magic != TTY_MAGIC) {
		mutex_unlock(&tty_mutex);
		return -EIO;
		}

		if (c > 0) {
		spin_lock_irqsave(&to->port->lock, flags);
		/* Stuff the data into the input queue of the other end */
		@@ -125,6 +131,7 @@ static int pty_write(struct tty_struct tty, const unsigned char buf, int c)
		tty_flip_buffer_push(to->port);
		spin_unlock_irqrestore(&to->port->lock, flags);
		}
		mutex_unlock(&tty_mutex);
		return c;
		}

drivers/tty/tty_io.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -1448,10 +1448,13 @@ static void release_one_tty(struct work_struct *work)
		struct tty_driver *driver = tty->driver;
		struct module *owner = driver->owner;

		mutex_lock(&tty_mutex);
		if (tty->ops->cleanup)
		tty->ops->cleanup(tty);

		tty->magic = 0;
		mutex_unlock(&tty_mutex);

		tty_driver_kref_put(driver);
		module_put(owner);

Admin message