Re: [PATCH] ttyprintk: Add TTY hangup callback.

[Samo Pogačnik]

Dne 23.04.2021 (pet) ob 06:22 +0200 je Jiri Slaby napisal(a):
> On 18. 04. 21, 13:16, Samo Pogačnik wrote:
> > Dne 15.04.2021 (čet) ob 09:22 +0900 je Tetsuo Handa napisal(a):
> > > syzbot is reporting hung task due to flood of
> > > 
> > >    tty_warn(tty, "%s: tty->count = 1 port count = %d\n", __func__,
> > >             port->count);
> > > 
> > > message [1], for ioctl(TIOCVHANGUP) prevents tty_port_close() from
> > > decrementing port->count due to tty_hung_up_p() == true.
> > > 
> > > ----------
> > > #include <sys/types.h>
> > > #include <sys/stat.h>
> > > #include <fcntl.h>
> > > #include <sys/ioctl.h>
> > > #include <unistd.h>
> > > 
> > > int main(int argc, char *argv[])
> > > {
> > > 	int i;
> > > 	int fd[10];
> > > 
> > > 	for (i = 0; i < 10; i++)
> > > 		fd[i] = open("/dev/ttyprintk", O_WRONLY);
> > > 	ioctl(fd[0], TIOCVHANGUP);
> > > 	for (i = 0; i < 10; i++)
> > > 		close(fd[i]);
> > > 	close(open("/dev/ttyprintk", O_WRONLY));
> > > 	return 0;
> > > }
> > > ----------
> > > 
> > > When TTY hangup happens, port->count needs to be reset via
> > > "struct tty_operations"->hangup callback.
> > > 
> > > [1]
> > > 
https://syzkaller.appspot.com/bug?id=39ea6caa479af471183997376dc7e90bc7d64a6a
> > > 
> > > Reported-by: syzbot <syzbot+43e93968b964e369db0b@xxxxxxxxxxxxxxxxxxxxxxxxx
> > > >
> > > Reported-by: syzbot <syzbot+3ed715090790806d8b18@xxxxxxxxxxxxxxxxxxxxxxxxx
> > > >
> > > Tested-by: syzbot <syzbot+43e93968b964e369db0b@xxxxxxxxxxxxxxxxxxxxxxxxx>
> > > Signed-off-by: Tetsuo Handa <penguin-kernel@xxxxxxxxxxxxxxxxxxx>
> > > Fixes: 24b4b67d17c308aa ("add ttyprintk driver")
> > > ---
> > >   drivers/char/ttyprintk.c | 11 +++++++++++
> > >   1 file changed, 11 insertions(+)
> > > 
> > > diff --git a/drivers/char/ttyprintk.c b/drivers/char/ttyprintk.c
> > > index 6a0059e508e3..93f5d11c830b 100644
> > > --- a/drivers/char/ttyprintk.c
> > > +++ b/drivers/char/ttyprintk.c
> > > @@ -158,12 +158,23 @@ static int tpk_ioctl(struct tty_struct *tty,
> > >   	return 0;
> > >   }
> > >   
> > > +/*
> > > + * TTY operations hangup function.
> > > + */
> > > +static void tpk_hangup(struct tty_struct *tty)
> > > +{
> > > +	struct ttyprintk_port *tpkp = tty->driver_data;
> > > +
> > > +	tty_port_hangup(&tpkp->port);
> > > +}
> > > +
> > >   static const struct tty_operations ttyprintk_ops = {
> > >   	.open = tpk_open,
> > >   	.close = tpk_close,
> > >   	.write = tpk_write,
> > >   	.write_room = tpk_write_room,
> > >   	.ioctl = tpk_ioctl,
> > > +	.hangup = tpk_hangup,
> > >   };
> > >   
> > >   static const struct tty_port_operations null_ops = { };
> > 
> > Using the supplied test code, i've tested the patch on my desktop running
> > the
> > 5.4 kernel. After applying the patch, the kernel warnings like "ttyprintk:
> > tty_port_close_start: tty->count = 1 port count = 11" do not appear any
> > more,
> > when the test code is run.
> > I think the patch is ok.
> 
> I wonder if the buffer shouldn't be flushed in hangup too? Or better, 
> the flush moved from tty_ops->close to tty_port->ops->shutdown?
> 
> thanks,

Good point. I tried the following additional change, which seems to do the
trick. What do you think?

thanks, Samo
---
 drivers/char/ttyprintk.c | 26 ++++++++++++++++++--------
 1 file changed, 18 insertions(+), 8 deletions(-)

diff --git a/drivers/char/ttyprintk.c b/drivers/char/ttyprintk.c
index 93f5d11c8..420222a92 100644
--- a/drivers/char/ttyprintk.c
+++ b/drivers/char/ttyprintk.c
@@ -100,12 +100,6 @@ static int tpk_open(struct tty_struct *tty, struct file
*filp)
 static void tpk_close(struct tty_struct *tty, struct file *filp)
 {
 	struct ttyprintk_port *tpkp = tty->driver_data;
-	unsigned long flags;
-
-	spin_lock_irqsave(&tpkp->spinlock, flags);
-	/* flush tpk_printk buffer */
-	tpk_printk(NULL, 0);
-	spin_unlock_irqrestore(&tpkp->spinlock, flags);
 
 	tty_port_close(&tpkp->port, tty, filp);
 }
@@ -168,6 +162,20 @@ static void tpk_hangup(struct tty_struct *tty)
 	tty_port_hangup(&tpkp->port);
 }
 
+/*
+ * TTY port operations shutdown function.
+ */
+static void tpk_port_shutdown(struct tty_port *tport)
+{
+	struct ttyprintk_port *tpkp =
+		container_of(tport, struct ttyprintk_port, port);
+	unsigned long flags;
+
+	spin_lock_irqsave(&tpkp->spinlock, flags);
+	tpk_flush();
+	spin_unlock_irqrestore(&tpkp->spinlock, flags);
+}
+
 static const struct tty_operations ttyprintk_ops = {
 	.open = tpk_open,
 	.close = tpk_close,
@@ -177,7 +185,9 @@ static const struct tty_operations ttyprintk_ops = {
 	.hangup = tpk_hangup,
 };
 
-static const struct tty_port_operations null_ops = { };
+static const struct tty_port_operations tpk_port_ops = {
+	.shutdown = tpk_port_shutdown,
+};
 
 static struct tty_driver *ttyprintk_driver;
 
@@ -195,7 +205,7 @@ static int __init ttyprintk_init(void)
 		return PTR_ERR(ttyprintk_driver);
 
 	tty_port_init(&tpk_port.port);
-	tpk_port.port.ops = &null_ops;
+	tpk_port.port.ops = &tpk_port_ops;
 
 	ttyprintk_driver->driver_name = "ttyprintk";
 	ttyprintk_driver->name = "ttyprintk";
-- 
2.17.1