From patchwork Fri Oct 28 12:07:48 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Rob Herring X-Patchwork-Id: 79914 Delivered-To: patch@linaro.org Received: by 10.140.97.247 with SMTP id m110csp1138589qge; Fri, 28 Oct 2016 05:08:02 -0700 (PDT) X-Received: by 10.107.46.199 with SMTP id u68mr10538897iou.2.1477656482201; Fri, 28 Oct 2016 05:08:02 -0700 (PDT) Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id j5si11007115pax.188.2016.10.28.05.08.01; Fri, 28 Oct 2016 05:08:02 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1760298AbcJ1MH4 (ORCPT + 27 others); Fri, 28 Oct 2016 08:07:56 -0400 Received: from mail-oi0-f67.google.com ([209.85.218.67]:33423 "EHLO mail-oi0-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1760037AbcJ1MHw (ORCPT ); Fri, 28 Oct 2016 08:07:52 -0400 Received: by mail-oi0-f67.google.com with SMTP id i127so2816867oia.0; Fri, 28 Oct 2016 05:07:51 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=qDQwwQc6Hu+VJeAjO7h4YN9z5dqEot5VtiTeBh8JY50=; b=PG+EhUvIJxPCPt9Ket1Ow6EB74Bi9/WUvOw28HrAyQe7pr9f919MynEhlxtZbkbaDN KhHt4pJiovDS5y3fBq0w/ReO82Hd07ZQkwbrqcFBCSln+ukeht7UvGFHCwrfcWwafTp2 ARiFvFj1irU1KCaTOXyqRKN7WQx77P9z+GNvj7SAvY/R9xZ41uBJe106g/lY7rKFYf3q FuIjQLcNHInISvL/W8ZK88uB/8/S3bp2VWVZoWB2Gyj2kZsLl0IOC+fvCbRRr1jewcFS qB4f4PZ3xAt00OqkAK3ZTZLrDmCKMVa5aCrQGAjKjcD5ClKkBHUA6Pu7xTkpAY/cN4Fd 2fMA== X-Gm-Message-State: ABUngvdxXniN9DRfaotfxmTL/AR7ofUsP67KRNHhcKGwFtyE63GCJXf13PLvuo6GRaLHgQ== X-Received: by 10.157.51.98 with SMTP id u31mr10061684otd.171.1477656471319; Fri, 28 Oct 2016 05:07:51 -0700 (PDT) Received: from rob-hp-laptop.herring.priv (72-48-98-129.dyn.grandenetworks.net. [72.48.98.129]) by smtp.googlemail.com with ESMTPSA id v126sm2875917oig.20.2016.10.28.05.07.50 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 28 Oct 2016 05:07:50 -0700 (PDT) From: Rob Herring To: Greg Kroah-Hartman Cc: linux-kernel@vger.kernel.org, Borislav Petkov , Mike Galbraith , Jiri Slaby , linux-serial@vger.kernel.org, =?UTF-8?q?Niklas=20S=C3=B6derlund?= , Geert Uytterhoeven , Mugunthan V N Subject: [PATCH 2/2] tty: serial_core: fix NULL struct tty pointer access in uart_write_wakeup Date: Fri, 28 Oct 2016 07:07:48 -0500 Message-Id: <20161028120748.27763-3-robh@kernel.org> X-Mailer: git-send-email 2.10.1 In-Reply-To: <20161028120748.27763-1-robh@kernel.org> References: <20161028120748.27763-1-robh@kernel.org> Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Since commit 761ed4a94582ab29 ("tty: serial_core: convert uart_close to use tty_port_close"), the serial console is broken on various systems and typing "reboot" splats the following on the serial console: INIT: Sending p[ 427.863916] BUG: unable to handle kernel NULL pointer dereference at 00000000000001e0 [ 427.885156] IP: [] tty_wakeup+0xc/0x70 [ 427.898337] PGD 0 [ 427.902051] [ 427.907498] Oops: 0000 [#1] PREEMPT SMP [ 427.917635] Modules linked in: nfsv3 nfs_acl nfs fscache lockd sunrpc grace edd af_packet cpufreq_conservative cpufreq_userspace cpufreq_powersave fuse loop md_mod dm_mod joydev hid_generic usbhid ipmi_ssif ohci_pci ohci_hcd ehci_pci ehci_hcd e1000e ptp firewire_ohci edac_core pps_core tpm_infineon sp5100_tco firewire_core acpi_cpufreq serio_raw pcspkr fjes usbcore shpchp edac_mce_amd tpm_tis ipmi_si tpm_tis_core i2c_piix4 k10temp sg ipmi_msghandler tpm sr_mod button cdrom kvm_amd kvm irqbypass crc_itu_t ast ttm drm_kms_helper drm fb_sys_fops sysimgblt sysfillrect syscopyarea i2c_algo_bit scsi_dh_rdac scsi_dh_alua scsi_dh_emc scsi_dh_hp_sw ata_generic pata_atiixp [ 428.054179] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.9.0-rc1-1.g73e3f23-default #1 [ 428.072868] Hardware name: System manufacturer System Product Name/KGP(M)E-D16, BIOS 0902 12/03/2010 [ 428.094755] task: ffffffffa2c0d500 task.stack: ffffffffa2c00000 [ 428.109717] RIP: 0010:[] [] tty_wakeup+0xc/0x70 [ 428.128407] RSP: 0018:ffff9a1a5fc03df8 EFLAGS: 00010086 [ 428.142184] RAX: ffff9a1857258000 RBX: ffffffffa3050ea0 RCX: 0000000000000000 [ 428.159649] RDX: 000000000000001b RSI: 0000000000000000 RDI: 0000000000000000 [ 428.177109] RBP: ffff9a1a5fc03e08 R08: 0000000000000000 R09: 0000000000000000 [ 428.194547] R10: 0000000000021c77 R11: 0000000000000000 R12: ffff9a1857258000 [ 428.212002] R13: 0000000000000000 R14: 0000000000000020 R15: 0000000000000020 [ 428.229481] FS: 0000000000000000(0000) GS:ffff9a1a5fc00000(0000) knlGS:0000000000000000 [ 428.248938] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 428.263726] CR2: 00000000000001e0 CR3: 0000000390c06000 CR4: 00000000000006f0 [ 428.281331] Stack: [ 428.288696] ffffffffa3050ea0 ffff9a1857258000 ffff9a1a5fc03e18 ffffffffa24e0ab1 [ 428.307064] ffff9a1a5fc03e40 ffffffffa24e8865 ffffffffa3050ea0 00000000000000c2 [ 428.325456] 0000000000000046 ffff9a1a5fc03e78 ffffffffa24e8a5f ffffffffa3050ea0 [ 428.343905] Call Trace: [ 428.352319] [ 428.356216] [] uart_write_wakeup+0x21/0x30 The problem is for console ports, the serial port is not shutdown and interrupts may fire after the struct tty is gone. Simply calling the tty_port helper tty_port_tty_wakeup instead of tty_wakeup directly will ensure there is a valid struct tty. Fixes: 761ed4a94582ab29 ("tty: serial_core: convert uart_close to use tty_port_close") Reported-by: Borislav Petkov Reported-by: Mike Galbraith Cc: Jiri Slaby Cc: Greg Kroah-Hartman Cc: linux-serial@vger.kernel.org Signed-off-by: Rob Herring --- drivers/tty/serial/serial_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) -- 2.10.1 diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c index ce8899c13af3..f2303f390345 100644 --- a/drivers/tty/serial/serial_core.c +++ b/drivers/tty/serial/serial_core.c @@ -111,7 +111,7 @@ void uart_write_wakeup(struct uart_port *port) * closed. No cookie for you. */ BUG_ON(!state); - tty_wakeup(state->port.tty); + tty_port_tty_wakeup(&state->port); } static void uart_stop(struct tty_struct *tty) @@ -632,7 +632,7 @@ static void uart_flush_buffer(struct tty_struct *tty) if (port->ops->flush_buffer) port->ops->flush_buffer(port); uart_port_unlock(port, flags); - tty_wakeup(tty); + tty_port_tty_wakeup(&state->port); } /*