Messages in this thread Patch in this message | | | Subject | Re: [PATCH] ttyprintk: Add TTY hangup callback. | From | Samo Pogačnik <> | Date | Fri, 23 Apr 2021 11:55:09 +0200 |
| |
Dne 23.04.2021 (pet) ob 06:22 +0200 je Jiri Slaby napisal(a): > On 18. 04. 21, 13:16, Samo Pogačnik wrote: > > Dne 15.04.2021 (čet) ob 09:22 +0900 je Tetsuo Handa napisal(a): > > > syzbot is reporting hung task due to flood of > > > > > > tty_warn(tty, "%s: tty->count = 1 port count = %d\n", __func__, > > > port->count); > > > > > > message [1], for ioctl(TIOCVHANGUP) prevents tty_port_close() from > > > decrementing port->count due to tty_hung_up_p() == true. > > > > > > ---------- > > > #include <sys/types.h> > > > #include <sys/stat.h> > > > #include <fcntl.h> > > > #include <sys/ioctl.h> > > > #include <unistd.h> > > > > > > int main(int argc, char *argv[]) > > > { > > > int i; > > > int fd[10]; > > > > > > for (i = 0; i < 10; i++) > > > fd[i] = open("/dev/ttyprintk", O_WRONLY); > > > ioctl(fd[0], TIOCVHANGUP); > > > for (i = 0; i < 10; i++) > > > close(fd[i]); > > > close(open("/dev/ttyprintk", O_WRONLY)); > > > return 0; > > > } > > > ---------- > > > > > > When TTY hangup happens, port->count needs to be reset via > > > "struct tty_operations"->hangup callback. > > > > > > [1] > > > https://syzkaller.appspot.com/bug?id=39ea6caa479af471183997376dc7e90bc7d64a6a > > > > > > Reported-by: syzbot <syzbot+43e93968b964e369db0b@syzkaller.appspotmail.com > > > > > > > Reported-by: syzbot <syzbot+3ed715090790806d8b18@syzkaller.appspotmail.com > > > > > > > Tested-by: syzbot <syzbot+43e93968b964e369db0b@syzkaller.appspotmail.com> > > > Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> > > > Fixes: 24b4b67d17c308aa ("add ttyprintk driver") > > > --- > > > drivers/char/ttyprintk.c | 11 +++++++++++ > > > 1 file changed, 11 insertions(+) > > > > > > diff --git a/drivers/char/ttyprintk.c b/drivers/char/ttyprintk.c > > > index 6a0059e508e3..93f5d11c830b 100644 > > > --- a/drivers/char/ttyprintk.c > > > +++ b/drivers/char/ttyprintk.c > > > @@ -158,12 +158,23 @@ static int tpk_ioctl(struct tty_struct *tty, > > > return 0; > > > } > > > > > > +/* > > > + * TTY operations hangup function. > > > + */ > > > +static void tpk_hangup(struct tty_struct *tty) > > > +{ > > > + struct ttyprintk_port *tpkp = tty->driver_data; > > > + > > > + tty_port_hangup(&tpkp->port); > > > +} > > > + > > > static const struct tty_operations ttyprintk_ops = { > > > .open = tpk_open, > > > .close = tpk_close, > > > .write = tpk_write, > > > .write_room = tpk_write_room, > > > .ioctl = tpk_ioctl, > > > + .hangup = tpk_hangup, > > > }; > > > > > > static const struct tty_port_operations null_ops = { }; > > > > Using the supplied test code, i've tested the patch on my desktop running > > the > > 5.4 kernel. After applying the patch, the kernel warnings like "ttyprintk: > > tty_port_close_start: tty->count = 1 port count = 11" do not appear any > > more, > > when the test code is run. > > I think the patch is ok. > > I wonder if the buffer shouldn't be flushed in hangup too? Or better, > the flush moved from tty_ops->close to tty_port->ops->shutdown? > > thanks,
Good point. I tried the following additional change, which seems to do the trick. What do you think?
thanks, Samo --- drivers/char/ttyprintk.c | 26 ++++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-)
diff --git a/drivers/char/ttyprintk.c b/drivers/char/ttyprintk.c index 93f5d11c8..420222a92 100644 --- a/drivers/char/ttyprintk.c +++ b/drivers/char/ttyprintk.c @@ -100,12 +100,6 @@ static int tpk_open(struct tty_struct *tty, struct file *filp) static void tpk_close(struct tty_struct *tty, struct file *filp) { struct ttyprintk_port *tpkp = tty->driver_data; - unsigned long flags; - - spin_lock_irqsave(&tpkp->spinlock, flags); - /* flush tpk_printk buffer */ - tpk_printk(NULL, 0); - spin_unlock_irqrestore(&tpkp->spinlock, flags); tty_port_close(&tpkp->port, tty, filp); } @@ -168,6 +162,20 @@ static void tpk_hangup(struct tty_struct *tty) tty_port_hangup(&tpkp->port); } +/* + * TTY port operations shutdown function. + */ +static void tpk_port_shutdown(struct tty_port *tport) +{ + struct ttyprintk_port *tpkp = + container_of(tport, struct ttyprintk_port, port); + unsigned long flags; + + spin_lock_irqsave(&tpkp->spinlock, flags); + tpk_flush(); + spin_unlock_irqrestore(&tpkp->spinlock, flags); +} + static const struct tty_operations ttyprintk_ops = { .open = tpk_open, .close = tpk_close, @@ -177,7 +185,9 @@ static const struct tty_operations ttyprintk_ops = { .hangup = tpk_hangup, }; -static const struct tty_port_operations null_ops = { }; +static const struct tty_port_operations tpk_port_ops = { + .shutdown = tpk_port_shutdown, +}; static struct tty_driver *ttyprintk_driver; @@ -195,7 +205,7 @@ static int __init ttyprintk_init(void) return PTR_ERR(ttyprintk_driver); tty_port_init(&tpk_port.port); - tpk_port.port.ops = &null_ops; + tpk_port.port.ops = &tpk_port_ops; ttyprintk_driver->driver_name = "ttyprintk"; ttyprintk_driver->name = "ttyprintk"; -- 2.17.1
| |