kernel_optimize_test/drivers/tty
Herton R. Krzesinski 1f55c718c2 pty: make sure super_block is still valid in final /dev/tty close
Considering current pty code and multiple devpts instances, it's possible
to umount a devpts file system while a program still has /dev/tty opened
pointing to a previosuly closed pty pair in that instance. In the case all
ptmx and pts/N files are closed, umount can be done. If the program closes
/dev/tty after umount is done, devpts_kill_index will use now an invalid
super_block, which was already destroyed in the umount operation after
running ->kill_sb. This is another "use after free" type of issue, but now
related to the allocated super_block instance.

To avoid the problem (warning at ida_remove and potential crashes) for
this specific case, I added two functions in devpts which grabs additional
references to the super_block, which pty code now uses so it makes sure
the super block structure is still valid until pty shutdown is done.
I also moved the additional inode references to the same functions, which
also covered similar case with inode being freed before /dev/tty final
close/shutdown.

Signed-off-by: Herton R. Krzesinski <herton@redhat.com>
Cc: stable@vger.kernel.org # 2.6.29+
Reviewed-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-02-06 23:45:46 -08:00
..
hvc TTY/Serial driver patches for 4.4-rc1 2015-11-04 21:35:12 -08:00
ipwireless
serial tty: Add support for PCIe WCH382 2S multi-IO card 2016-02-06 23:08:00 -08:00
vt Staging fixes for 4.5-rc2 2016-01-31 17:00:27 -08:00
amiserial.c tty: Remove unused SERIAL_DO_RESTART define 2015-12-13 19:59:48 -08:00
bfin_jtag_comm.c
cyclades.c cyclades: Deinline cyz_is_loaded, save 240 bytes 2015-12-13 19:59:48 -08:00
ehv_bytechan.c
goldfish.c staging: goldfish: Fix pointer cast for 32 bits 2015-05-31 11:40:14 +09:00
isicom.c isicom: Deinline drop_dtr, save 112 bytes 2015-12-13 19:59:48 -08:00
Kconfig
Makefile
metag_da.c tty/metag_da: Avoid module_init/module_exit in non-modular code 2015-06-16 14:12:31 -04:00
mips_ejtag_fdc.c ttyFDC: Fix build problems due to use of module_{init,exit} 2015-10-17 21:29:21 -07:00
moxa.c tty: Remove unused SERIAL_DO_RESTART define 2015-12-13 19:59:48 -08:00
moxa.h
mxser.c
mxser.h
n_gsm.c tty: Convert use of __constant_htons to htons 2015-07-23 15:10:25 -07:00
n_hdlc.c pty: Fix input race when closing 2015-05-10 19:26:37 +02:00
n_r3964.c tty: r3964: Replace/remove bogus tty lock use 2015-10-17 21:11:29 -07:00
n_tracerouter.c n_tracerouter: stop including <asm-generic/bug> 2015-10-15 00:21:10 +02:00
n_tracesink.c n_tracesink: stop including <asm-generic/bug> 2015-10-15 00:21:11 +02:00
n_tracesink.h
n_tty.c n_tty: Fix unsafe reference to "other" ldisc 2016-01-26 23:17:54 -08:00
nozomi.c drivers/tty/nozomi.c: rename CONFIG_MAGIC 2015-05-10 19:19:06 +02:00
pty.c pty: make sure super_block is still valid in final /dev/tty close 2016-02-06 23:45:46 -08:00
rocket_int.h
rocket.c tty: Remove tty_port::close_wait 2015-10-17 21:11:29 -07:00
rocket.h tty: rocket: fix comment of ROCKET_SPD_HI 2015-05-24 12:49:16 -07:00
synclink_gt.c tty: synclink_gt: Rename tty_driver_name 2015-12-13 19:59:48 -08:00
synclink.c tty: synclink, fix indentation 2015-10-17 21:14:06 -07:00
synclinkmp.c tty: Remove ASYNC_CLOSING checks in open()/hangup() methods 2015-10-17 21:11:29 -07:00
sysrq.c sysrq: Fix warning in sysrq generated crash. 2015-12-29 16:29:18 -08:00
tty_audit.c tty: audit: Fix audit source 2015-11-20 16:19:54 -08:00
tty_buffer.c tty: Fix GPF in flush_to_ldisc() 2015-12-12 23:05:28 -08:00
tty_io.c tty: Drop krefs for interrupted tty lock 2016-02-06 16:56:46 -08:00
tty_ioctl.c tty: Remove __func__ from tty_debug() macro 2015-12-13 19:59:48 -08:00
tty_ldisc.c tty: Prevent ldisc drivers from re-using stale tty fields 2015-12-13 19:59:48 -08:00
tty_ldsem.c tty: Deinline __ldsem_down_write_nested, save 128 bytes 2015-12-13 19:59:48 -08:00
tty_mutex.c tty: Drop krefs for interrupted tty lock 2016-02-06 16:56:46 -08:00
tty_port.c tty: Define tty_*() printk macros 2015-12-13 19:59:48 -08:00