lkml.org 
[lkml]   [2012]   [Mar]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectRe: [PATCH] tty: hold lock across tty buffer finding and buffer filling
    Date


    > On 03/16/2012 02:50 PM, Du, Alek wrote:
    >> For #1, as I said, we already held the tty refcount. The tty refcount cannot help this crash.
    >
    > Where exactly? Do you have some local changes?
    > $ grep tty_port_tty_ drivers/tty/serial/mfd.c
    > $

    Yes, we do have local changes not upstream yet. But you should know now, TTY recount is not the key of the spin lock hole.


    >
    >> For #2, this patch will avoid memcpy to a NULL pointer and avoid a kernel crash.
    >
    > Ok, could you explain how? Linearized code from moxa.c with your patch
    > applied follows:
    > ofs = baseAddr + DynPage_addr + bufhead + head;
    > size = (tail >= head) ? (tail - head) : (rx_mask + 1 - head);
    > size = min(size, count);
    > // call to tty_prepare_flip_string
    > spin_lock_irqsave(&tty->buf.lock, flags);
    > space = __tty_buffer_request_room(tty, size);
    >
    > tb = tty->buf.tail;
    > if (likely(space)) {
    > *chars = tb->char_buf_ptr + tb->used;
    > memset(tb->flag_buf_ptr + tb->used, TTY_NORMAL, space);
    > tb->used += space;
    > }
    > spin_unlock_irqrestore(&tty->buf.lock, flags);
    > // return to MoxaPortReadData
    > memcpy_fromio(*chars, ofs, space); <- memcpy without buf.lock

    Ok. This is true. Seems we need another patch to remove this prepare interface. And let callers use the protected interface.

    Thanks,
    Alek


    > head = (head + len) & rx_mask;
    > ...
    >
    > thanks,
    > --
    > js
    > suse labs


    \
     
     \ /
      Last update: 2012-03-17 02:09    [W:0.025 / U:0.240 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site