linux-toradex.git/drivers/tty/tty_io.c, branch v3.0.44

TTY: make tty_add_file non-failing

2011-11-11T17:35:12+00:00

commit fa90e1c935472281de314e6d7c9a37db9cbc2e4e upstream.

If tty_add_file fails at the point it is now, we have to revert all
the changes we did to the tty. It means either decrease all refcounts
if this was a tty reopen or delete the tty if it was newly allocated.

There was a try to fix this in v3.0-rc2 using tty_release in 0259894c7
(TTY: fix fail path in tty_open). But instead it introduced a NULL
dereference. It's because tty_release dereferences
filp->private_data, but that one is set even in our tty_add_file. And
when tty_add_file fails, it's still NULL/garbage. Hence tty_release
cannot be called there.

To circumvent the original leak (and the current NULL deref) we split
tty_add_file into two functions, making the latter non-failing. In
that case we may do the former early in open, where handling failures
is easy. The latter stays as it is now. So there is no change in
functionality.

The original bug (leak) was introduced by f573bd176 (tty: Remove
__GFP_NOFAIL from tty_add_file()). Thanks Dan for reporting this.

Later, we may split tty_release into more functions and call only some
of them in this fail path instead. (If at all possible.)

Introduced-in: v2.6.37-rc2
Signed-off-by: Jiri Slaby 
Reported-by: Dan Carpenter 
Cc: Alan Cox 
Cc: Pekka Enberg 
Signed-off-by: Greg Kroah-Hartman

TTY: drop driver reference in tty_open fail path

2011-11-11T17:35:12+00:00

commit c290f8358acaeffd8e0c551ddcc24d1206143376 upstream.

When tty_driver_lookup_tty fails in tty_open, we forget to drop a
reference to the tty driver. This was added by commit 4a2b5fddd5 (Move
tty lookup/reopen to caller).

Fix that by adding tty_driver_kref_put to the fail path.

I will refactor the code later. This is for the ease of backporting to
stable.

Introduced-in: v2.6.28-rc2
Signed-off-by: Jiri Slaby 
Cc: Alan Cox 
Acked-by: Sukadev Bhattiprolu 
Signed-off-by: Greg Kroah-Hartman

TTY: pty, fix pty counting

2011-10-03T18:39:49+00:00

commit 24d406a6bf736f7aebdc8fa0f0ec86e0890c6d24 upstream.

tty_operations->remove is normally called like:
queue_release_one_tty
 ->tty_shutdown
   ->tty_driver_remove_tty
     ->tty_operations->remove

However tty_shutdown() is called from queue_release_one_tty() only if
tty_operations->shutdown is NULL. But for pty, it is not.
pty_unix98_shutdown() is used there as ->shutdown.

So tty_operations->remove of pty (i.e. pty_unix98_remove()) is never
called. This results in invalid pty_count. I.e. what can be seen in
/proc/sys/kernel/pty/nr.

I see this was already reported at:
  https://lkml.org/lkml/2009/11/5/370
But it was not fixed since then.

This patch is kind of a hackish way. The problem lies in ->install. We
allocate there another tty (so-called tty->link). So ->install is
called once, but ->remove twice, for both tty and tty->link. The fix
here is to count both tty and tty->link and divide the count by 2 for
user.

And to have ->remove called, let's make tty_driver_remove_tty() global
and call that from pty_unix98_shutdown() (tty_operations->shutdown).

While at it, let's document that when ->shutdown is defined,
tty_shutdown() is not called.

Signed-off-by: Jiri Slaby 
Cc: Alan Cox 
Cc: "H. Peter Anvin" 
Signed-off-by: Greg Kroah-Hartman

TTY: tty_io, annotate locking functions

2011-04-25T21:19:12+00:00

tty_write_lock and tty_write_unlock contain imbalanced locking. But
this is intentional, so mark them appropriately by
__acquires/__releases.

Signed-off-by: Jiri Slaby 
Signed-off-by: Greg Kroah-Hartman

tty: remove invalid location line in file header

2011-04-19T23:33:36+00:00

remove invalid location line in each file header after location
moved from driver/char to driver/tty

Signed-off-by: Jovi Zhang 
Signed-off-by: Greg Kroah-Hartman

TTY: fix fail path in tty_open

2011-04-19T21:43:01+00:00

When tty_add_file fails we omit to clean up. Fix that by calling
tty_release appropriatelly.

Signed-off-by: Jiri Slaby 
Cc: Alan Cox 
Signed-off-by: Greg Kroah-Hartman

TTY: plug in deinitialize_tty_struct

2011-04-19T21:43:01+00:00

Used the newly introduced deinitialize_tty_struct to properly shut
down ldisc.

It is intended to fix the Julian's reported problem. He reports that
kmemleak checker warns about memory leak:
unreferenced object 0xc0e19860 (size 8):
comm cat, pid 1226, jiffies 4294919464 (age 287.476s)
hex dump (first 8 bytes):
44 de 2d c1 01 00 00 00 D.-.....
backtrace:
[] create_object+0x109/0x1ad
[] kmem_cache_alloc+0x60/0x68
[] tty_ldisc_get+0x54/0x76
[] tty_ldisc_init+0xa/0x20
[] initialize_tty_struct+0x2d/0x1ac
[] tty_init_dev+0x59/0x10d
[] tty_open+0x24a/0x3a2
...

Signed-off-by: Jiri Slaby 
Cc: Alan Cox 
Reported-by: Julian Anastasov 
Signed-off-by: Greg Kroah-Hartman

TTY: introduce deinit helpers for proper ldisc shutdown

2011-04-19T21:43:01+00:00

Introduce deinitialize_tty_struct which should be called after
initialize_tty_struct and before successfull tty_ldisc_setup.

It calls tty_ldisc_deinit which is opposite of tty_ldisc_init. It only
puts a reference to ldisc and assigns NULL to tty->ldisc.

It will be used to shut down ldisc when tty_release cannot be called
yet.

Signed-off-by: Jiri Slaby 
Cc: Alan Cox 
Cc: Julian Anastasov 
Signed-off-by: Greg Kroah-Hartman

TTY: unify tty_init_dev fail path handling

2011-04-19T21:42:59+00:00

Change it so that we call the deinit functions at one place at the end
of the function (by gotos). And while at it use some sane label names.

This is a preparation for the deinitialization of tty in the next
patch.

Signed-off-by: Jiri Slaby 
Cc: Alan Cox 
Cc: Julian Anastasov 
Signed-off-by: Greg Kroah-Hartman

vt: remove uneeded retval check before tty->ops->open inside tty_open

2011-04-19T21:39:28+00:00

The current check is uneeded, since !retval will always returns true,
as retval returned from tty_add_file is checked earlier and tty_open
exits if it's not zero.

Acked-by: Alan Cox 
Signed-off-by: Herton Ronaldo Krzesinski 
Signed-off-by: Greg Kroah-Hartman