search for: port_fops_open

...at.com> --- drivers/char/virtio_console.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c index 291f437..b04ec95 100644 --- a/drivers/char/virtio_console.c +++ b/drivers/char/virtio_console.c @@ -1024,6 +1024,10 @@ static int port_fops_open(struct inode *inode, struct file *filp) /* We get the port with a kref here */ port = find_port_by_devt(cdev->dev); + if (!port) { + /* Port was unplugged before we could proceed */ + return -ENXIO; + } filp->private_data = port; /* -- 1.8.1.4

From: Sjur Br?ndeland <sjur.brandeland at stericsson.com> This reverts commit 8078db789a92b10ff6e2d713231b5367e014c53b. The reverted patch caused opening of ports to fail for rproc_serial. In probe guest_connected was set to true, but port_fops_open() fails with -EMFILE if guest_connected already is true. Signed-off-by: Sjur Br?ndeland <sjur.brandeland at stericsson.com> --- Hi Rusty, Here is a fix intended for 3.9. Sorry for the churn here :-( Regards, Sjur drivers/char/virtio_console.c | 7 +++++-- 1 files changed, 5 insertions...

From: Sjur Br?ndeland <sjur.brandeland at stericsson.com> This reverts commit 8078db789a92b10ff6e2d713231b5367e014c53b. The reverted patch caused opening of ports to fail for rproc_serial. In probe guest_connected was set to true, but port_fops_open() fails with -EMFILE if guest_connected already is true. Signed-off-by: Sjur Br?ndeland <sjur.brandeland at stericsson.com> --- Hi Rusty, Here is a fix intended for 3.9. Sorry for the churn here :-( Regards, Sjur drivers/char/virtio_console.c | 7 +++++-- 1 files changed, 5 insertions...

...-after-free in port unplug * patch 7 introduced a regression where the wake_up_interruptible was done before guest_connected and host_connected were set to false Please review and apply, Amit Shah (11): virtio: console: fix race with port unplug and open/close virtio: console: fix race in port_fops_open() and port unplug virtio: console: clean up port data immediately at time of unplug virtio: console: return -ENODEV on all read operations after unplug virtio: console: update private_data in struct file only on successful open virtio: console: fix race in port_fops_poll() and port unpl...

...-after-free in port unplug * patch 7 introduced a regression where the wake_up_interruptible was done before guest_connected and host_connected were set to false Please review and apply, Amit Shah (11): virtio: console: fix race with port unplug and open/close virtio: console: fix race in port_fops_open() and port unplug virtio: console: clean up port data immediately at time of unplug virtio: console: return -ENODEV on all read operations after unplug virtio: console: update private_data in struct file only on successful open virtio: console: fix race in port_fops_poll() and port unpl...

...--- drivers/char/virtio_console.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c index a39702a..7728af9 100644 --- a/drivers/char/virtio_console.c +++ b/drivers/char/virtio_console.c @@ -1032,7 +1032,6 @@ static int port_fops_open(struct inode *inode, struct file *filp) /* Port was unplugged before we could proceed */ return -ENXIO; } - filp->private_data = port; /* * Don't allow opening of console port devices -- that's done @@ -1051,6 +1050,7 @@ static int port_fops_open(struct inode *inode, struc...

...| 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c > index a39702a..7728af9 100644 > --- a/drivers/char/virtio_console.c > +++ b/drivers/char/virtio_console.c > @@ -1032,7 +1032,6 @@ static int port_fops_open(struct inode *inode, struct file *filp) > /* Port was unplugged before we could proceed */ > return -ENXIO; > } > - filp->private_data = port; > > /* > * Don't allow opening of console port devices -- that's done > @@ -1051,6 +1050,7 @@ static int p...

...| 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c > index a39702a..7728af9 100644 > --- a/drivers/char/virtio_console.c > +++ b/drivers/char/virtio_console.c > @@ -1032,7 +1032,6 @@ static int port_fops_open(struct inode *inode, struct file *filp) > /* Port was unplugged before we could proceed */ > return -ENXIO; > } > - filp->private_data = port; > > /* > * Don't allow opening of console port devices -- that's done > @@ -1051,6 +1050,7 @@ static int p...

...s for stable@ as well. I went over the list twice to check if really each one should go to stable, and to me it looks like all are stable candidates. Please review and apply if appropriate, Amit Shah (10): virtio: console: fix race with port unplug and open/close virtio: console: fix race in port_fops_open() and port unplug virtio: console: clean up port data immediately at time of unplug virtio: console: return -ENODEV on all read operations after unplug virtio: console: update private_data in struct file only on successful open virtio: console: fix race in port_fops_poll() and port unpl...

...s for stable@ as well. I went over the list twice to check if really each one should go to stable, and to me it looks like all are stable candidates. Please review and apply if appropriate, Amit Shah (10): virtio: console: fix race with port unplug and open/close virtio: console: fix race in port_fops_open() and port unplug virtio: console: clean up port data immediately at time of unplug virtio: console: return -ENODEV on all read operations after unplug virtio: console: update private_data in struct file only on successful open virtio: console: fix race in port_fops_poll() and port unpl...

Hey Rusty, These are the patches that rework a few bits to make hot-unplug while ports are open not crash apps (or kernels). The problem is when hot-unplug is performed when a port is open, the cdev struct is kept around by the file pointers and when the app later does a 'close', things go boom-boom. This patch series makes sure port as well as device hot-unplug is now safe to perform

Hey Rusty, These are the patches that rework a few bits to make hot-unplug while ports are open not crash apps (or kernels). The problem is when hot-unplug is performed when a port is open, the cdev struct is kept around by the file pointers and when the app later does a 'close', things go boom-boom. This patch series makes sure port as well as device hot-unplug is now safe to perform

...? drivers/char/virtio_console.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c index ce5f3fc..b94be04 100644 --- a/drivers/char/virtio_console.c +++ b/drivers/char/virtio_console.c @@ -1040,7 +1040,7 @@ static int port_fops_open(struct inode *inode, struct file *filp) spin_lock_irq(&port->inbuf_lock); if (port->guest_connected) { spin_unlock_irq(&port->inbuf_lock); - ret = -EMFILE; + ret = -EBUSY; goto out; } -- 1.8.1.4

...? drivers/char/virtio_console.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c index ce5f3fc..b94be04 100644 --- a/drivers/char/virtio_console.c +++ b/drivers/char/virtio_console.c @@ -1040,7 +1040,7 @@ static int port_fops_open(struct inode *inode, struct file *filp) spin_lock_irq(&port->inbuf_lock); if (port->guest_connected) { spin_unlock_irq(&port->inbuf_lock); - ret = -EMFILE; + ret = -EBUSY; goto out; } -- 1.8.1.4

...patch 11: Jason found a use-after-free in port unplug * patch 7 introduced a regression where the wake_up_interruptible was done before guest_connected and host_connected were set to false Amit Shah (9): virtio: console: fix race with port unplug and open/close virtio: console: fix race in port_fops_open() and port unplug virtio: console: clean up port data immediately at time of unplug virtio: console: fix raising SIGIO after port unplug virtio: console: return -ENODEV on all read operations after unplug virtio: console: add locks around buffer removal in port unplug path virtio: console...

...patch 11: Jason found a use-after-free in port unplug * patch 7 introduced a regression where the wake_up_interruptible was done before guest_connected and host_connected were set to false Amit Shah (9): virtio: console: fix race with port unplug and open/close virtio: console: fix race in port_fops_open() and port unplug virtio: console: clean up port data immediately at time of unplug virtio: console: fix raising SIGIO after port unplug virtio: console: return -ENODEV on all read operations after unplug virtio: console: add locks around buffer removal in port unplug path virtio: console...

...analysis. > > Markus Elfring (11): > Use kmalloc_array() in init_vqs() > Less function calls in init_vqs() after error detection > Rename a jump label in init() > Rename jump labels in virtcons_probe() > Rename jump labels in add_port() > Rename a jump label in port_fops_open() > Rename a jump label in port_fops_splice_write() > Rename jump labels in port_fops_write() > Rename a jump label in __send_to_port() > Rename jump labels in alloc_buf() > Rename a jump label in five functions > > drivers/char/virtio_console.c | 155 ++++++++++++++...

...analysis. > > Markus Elfring (11): > Use kmalloc_array() in init_vqs() > Less function calls in init_vqs() after error detection > Rename a jump label in init() > Rename jump labels in virtcons_probe() > Rename jump labels in add_port() > Rename a jump label in port_fops_open() > Rename a jump label in port_fops_splice_write() > Rename jump labels in port_fops_write() > Rename a jump label in __send_to_port() > Rename jump labels in alloc_buf() > Rename a jump label in five functions > > drivers/char/virtio_console.c | 155 ++++++++++++++...

...->cdev->dev == dev) + list_for_each_entry(port, &portdev->ports, list) { + if (port->cdev->dev == dev) { + kref_get(&port->kref); goto out; + } + } port = NULL; out: spin_unlock_irqrestore(&portdev->ports_lock, flags); @@ -1019,14 +1022,10 @@ static int port_fops_open(struct inode *inode, struct file *filp) struct port *port; int ret; + /* We get the port with a kref here */ port = find_port_by_devt(cdev->dev); filp->private_data = port; - /* Prevent against a port getting hot-unplugged at the same time */ - spin_lock_irq(&port->portdev-...

...struct splice_desc *sd) { @@ -976,6 +977,7 @@ error_out: pipe_unlock(pipe); return ret; } +#endif /* #ifdef CONFIG_SYSCALL_SPLICE */ static unsigned int port_fops_poll(struct file *filp, poll_table *wait) { @@ -1109,7 +1111,7 @@ static const struct file_operations port_fops = { .open = port_fops_open, .read = port_fops_read, .write = port_fops_write, - .splice_write = port_fops_splice_write, + SPLICE_WRITE_INIT(port_fops_splice_write) .poll = port_fops_poll, .release = port_fops_release, .fasync = port_fops_fasync, -- 1.9.1