<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux.git/drivers/tty/tty_io.c, branch v4.18.12</title>
<subtitle>Clone of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git</subtitle>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/'/>
<entry>
<title>vfs: change inode times to use struct timespec64</title>
<updated>2018-06-05T23:57:31+00:00</updated>
<author>
<name>Deepa Dinamani</name>
<email>deepa.kernel@gmail.com</email>
</author>
<published>2018-05-09T02:36:02+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=95582b00838837fc07e042979320caf917ce3fe6'/>
<id>95582b00838837fc07e042979320caf917ce3fe6</id>
<content type='text'>
struct timespec is not y2038 safe. Transition vfs to use
y2038 safe struct timespec64 instead.

The change was made with the help of the following cocinelle
script. This catches about 80% of the changes.
All the header file and logic changes are included in the
first 5 rules. The rest are trivial substitutions.
I avoid changing any of the function signatures or any other
filesystem specific data structures to keep the patch simple
for review.

The script can be a little shorter by combining different cases.
But, this version was sufficient for my usecase.

virtual patch

@ depends on patch @
identifier now;
@@
- struct timespec
+ struct timespec64
  current_time ( ... )
  {
- struct timespec now = current_kernel_time();
+ struct timespec64 now = current_kernel_time64();
  ...
- return timespec_trunc(
+ return timespec64_trunc(
  ... );
  }

@ depends on patch @
identifier xtime;
@@
 struct \( iattr \| inode \| kstat \) {
 ...
-       struct timespec xtime;
+       struct timespec64 xtime;
 ...
 }

@ depends on patch @
identifier t;
@@
 struct inode_operations {
 ...
int (*update_time) (...,
-       struct timespec t,
+       struct timespec64 t,
...);
 ...
 }

@ depends on patch @
identifier t;
identifier fn_update_time =~ "update_time$";
@@
 fn_update_time (...,
- struct timespec *t,
+ struct timespec64 *t,
 ...) { ... }

@ depends on patch @
identifier t;
@@
lease_get_mtime( ... ,
- struct timespec *t
+ struct timespec64 *t
  ) { ... }

@te depends on patch forall@
identifier ts;
local idexpression struct inode *inode_node;
identifier i_xtime =~ "^i_[acm]time$";
identifier ia_xtime =~ "^ia_[acm]time$";
identifier fn_update_time =~ "update_time$";
identifier fn;
expression e, E3;
local idexpression struct inode *node1;
local idexpression struct inode *node2;
local idexpression struct iattr *attr1;
local idexpression struct iattr *attr2;
local idexpression struct iattr attr;
identifier i_xtime1 =~ "^i_[acm]time$";
identifier i_xtime2 =~ "^i_[acm]time$";
identifier ia_xtime1 =~ "^ia_[acm]time$";
identifier ia_xtime2 =~ "^ia_[acm]time$";
@@
(
(
- struct timespec ts;
+ struct timespec64 ts;
|
- struct timespec ts = current_time(inode_node);
+ struct timespec64 ts = current_time(inode_node);
)

&lt;+... when != ts
(
- timespec_equal(&amp;inode_node-&gt;i_xtime, &amp;ts)
+ timespec64_equal(&amp;inode_node-&gt;i_xtime, &amp;ts)
|
- timespec_equal(&amp;ts, &amp;inode_node-&gt;i_xtime)
+ timespec64_equal(&amp;ts, &amp;inode_node-&gt;i_xtime)
|
- timespec_compare(&amp;inode_node-&gt;i_xtime, &amp;ts)
+ timespec64_compare(&amp;inode_node-&gt;i_xtime, &amp;ts)
|
- timespec_compare(&amp;ts, &amp;inode_node-&gt;i_xtime)
+ timespec64_compare(&amp;ts, &amp;inode_node-&gt;i_xtime)
|
ts = current_time(e)
|
fn_update_time(..., &amp;ts,...)
|
inode_node-&gt;i_xtime = ts
|
node1-&gt;i_xtime = ts
|
ts = inode_node-&gt;i_xtime
|
&lt;+... attr1-&gt;ia_xtime ...+&gt; = ts
|
ts = attr1-&gt;ia_xtime
|
ts.tv_sec
|
ts.tv_nsec
|
btrfs_set_stack_timespec_sec(..., ts.tv_sec)
|
btrfs_set_stack_timespec_nsec(..., ts.tv_nsec)
|
- ts = timespec64_to_timespec(
+ ts =
...
-)
|
- ts = ktime_to_timespec(
+ ts = ktime_to_timespec64(
...)
|
- ts = E3
+ ts = timespec_to_timespec64(E3)
|
- ktime_get_real_ts(&amp;ts)
+ ktime_get_real_ts64(&amp;ts)
|
fn(...,
- ts
+ timespec64_to_timespec(ts)
,...)
)
...+&gt;
(
&lt;... when != ts
- return ts;
+ return timespec64_to_timespec(ts);
...&gt;
)
|
- timespec_equal(&amp;node1-&gt;i_xtime1, &amp;node2-&gt;i_xtime2)
+ timespec64_equal(&amp;node1-&gt;i_xtime2, &amp;node2-&gt;i_xtime2)
|
- timespec_equal(&amp;node1-&gt;i_xtime1, &amp;attr2-&gt;ia_xtime2)
+ timespec64_equal(&amp;node1-&gt;i_xtime2, &amp;attr2-&gt;ia_xtime2)
|
- timespec_compare(&amp;node1-&gt;i_xtime1, &amp;node2-&gt;i_xtime2)
+ timespec64_compare(&amp;node1-&gt;i_xtime1, &amp;node2-&gt;i_xtime2)
|
node1-&gt;i_xtime1 =
- timespec_trunc(attr1-&gt;ia_xtime1,
+ timespec64_trunc(attr1-&gt;ia_xtime1,
...)
|
- attr1-&gt;ia_xtime1 = timespec_trunc(attr2-&gt;ia_xtime2,
+ attr1-&gt;ia_xtime1 =  timespec64_trunc(attr2-&gt;ia_xtime2,
...)
|
- ktime_get_real_ts(&amp;attr1-&gt;ia_xtime1)
+ ktime_get_real_ts64(&amp;attr1-&gt;ia_xtime1)
|
- ktime_get_real_ts(&amp;attr.ia_xtime1)
+ ktime_get_real_ts64(&amp;attr.ia_xtime1)
)

@ depends on patch @
struct inode *node;
struct iattr *attr;
identifier fn;
identifier i_xtime =~ "^i_[acm]time$";
identifier ia_xtime =~ "^ia_[acm]time$";
expression e;
@@
(
- fn(node-&gt;i_xtime);
+ fn(timespec64_to_timespec(node-&gt;i_xtime));
|
 fn(...,
- node-&gt;i_xtime);
+ timespec64_to_timespec(node-&gt;i_xtime));
|
- e = fn(attr-&gt;ia_xtime);
+ e = fn(timespec64_to_timespec(attr-&gt;ia_xtime));
)

@ depends on patch forall @
struct inode *node;
struct iattr *attr;
identifier i_xtime =~ "^i_[acm]time$";
identifier ia_xtime =~ "^ia_[acm]time$";
identifier fn;
@@
{
+ struct timespec ts;
&lt;+...
(
+ ts = timespec64_to_timespec(node-&gt;i_xtime);
fn (...,
- &amp;node-&gt;i_xtime,
+ &amp;ts,
...);
|
+ ts = timespec64_to_timespec(attr-&gt;ia_xtime);
fn (...,
- &amp;attr-&gt;ia_xtime,
+ &amp;ts,
...);
)
...+&gt;
}

@ depends on patch forall @
struct inode *node;
struct iattr *attr;
struct kstat *stat;
identifier ia_xtime =~ "^ia_[acm]time$";
identifier i_xtime =~ "^i_[acm]time$";
identifier xtime =~ "^[acm]time$";
identifier fn, ret;
@@
{
+ struct timespec ts;
&lt;+...
(
+ ts = timespec64_to_timespec(node-&gt;i_xtime);
ret = fn (...,
- &amp;node-&gt;i_xtime,
+ &amp;ts,
...);
|
+ ts = timespec64_to_timespec(node-&gt;i_xtime);
ret = fn (...,
- &amp;node-&gt;i_xtime);
+ &amp;ts);
|
+ ts = timespec64_to_timespec(attr-&gt;ia_xtime);
ret = fn (...,
- &amp;attr-&gt;ia_xtime,
+ &amp;ts,
...);
|
+ ts = timespec64_to_timespec(attr-&gt;ia_xtime);
ret = fn (...,
- &amp;attr-&gt;ia_xtime);
+ &amp;ts);
|
+ ts = timespec64_to_timespec(stat-&gt;xtime);
ret = fn (...,
- &amp;stat-&gt;xtime);
+ &amp;ts);
)
...+&gt;
}

@ depends on patch @
struct inode *node;
struct inode *node2;
identifier i_xtime1 =~ "^i_[acm]time$";
identifier i_xtime2 =~ "^i_[acm]time$";
identifier i_xtime3 =~ "^i_[acm]time$";
struct iattr *attrp;
struct iattr *attrp2;
struct iattr attr ;
identifier ia_xtime1 =~ "^ia_[acm]time$";
identifier ia_xtime2 =~ "^ia_[acm]time$";
struct kstat *stat;
struct kstat stat1;
struct timespec64 ts;
identifier xtime =~ "^[acmb]time$";
expression e;
@@
(
( node-&gt;i_xtime2 \| attrp-&gt;ia_xtime2 \| attr.ia_xtime2 \) = node-&gt;i_xtime1  ;
|
 node-&gt;i_xtime2 = \( node2-&gt;i_xtime1 \| timespec64_trunc(...) \);
|
 node-&gt;i_xtime2 = node-&gt;i_xtime1 = node-&gt;i_xtime3 = \(ts \| current_time(...) \);
|
 node-&gt;i_xtime1 = node-&gt;i_xtime3 = \(ts \| current_time(...) \);
|
 stat-&gt;xtime = node2-&gt;i_xtime1;
|
 stat1.xtime = node2-&gt;i_xtime1;
|
( node-&gt;i_xtime2 \| attrp-&gt;ia_xtime2 \) = attrp-&gt;ia_xtime1  ;
|
( attrp-&gt;ia_xtime1 \| attr.ia_xtime1 \) = attrp2-&gt;ia_xtime2;
|
- e = node-&gt;i_xtime1;
+ e = timespec64_to_timespec( node-&gt;i_xtime1 );
|
- e = attrp-&gt;ia_xtime1;
+ e = timespec64_to_timespec( attrp-&gt;ia_xtime1 );
|
node-&gt;i_xtime1 = current_time(...);
|
 node-&gt;i_xtime2 = node-&gt;i_xtime1 = node-&gt;i_xtime3 =
- e;
+ timespec_to_timespec64(e);
|
 node-&gt;i_xtime1 = node-&gt;i_xtime3 =
- e;
+ timespec_to_timespec64(e);
|
- node-&gt;i_xtime1 = e;
+ node-&gt;i_xtime1 = timespec_to_timespec64(e);
)

Signed-off-by: Deepa Dinamani &lt;deepa.kernel@gmail.com&gt;
Cc: &lt;anton@tuxera.com&gt;
Cc: &lt;balbi@kernel.org&gt;
Cc: &lt;bfields@fieldses.org&gt;
Cc: &lt;darrick.wong@oracle.com&gt;
Cc: &lt;dhowells@redhat.com&gt;
Cc: &lt;dsterba@suse.com&gt;
Cc: &lt;dwmw2@infradead.org&gt;
Cc: &lt;hch@lst.de&gt;
Cc: &lt;hirofumi@mail.parknet.co.jp&gt;
Cc: &lt;hubcap@omnibond.com&gt;
Cc: &lt;jack@suse.com&gt;
Cc: &lt;jaegeuk@kernel.org&gt;
Cc: &lt;jaharkes@cs.cmu.edu&gt;
Cc: &lt;jslaby@suse.com&gt;
Cc: &lt;keescook@chromium.org&gt;
Cc: &lt;mark@fasheh.com&gt;
Cc: &lt;miklos@szeredi.hu&gt;
Cc: &lt;nico@linaro.org&gt;
Cc: &lt;reiserfs-devel@vger.kernel.org&gt;
Cc: &lt;richard@nod.at&gt;
Cc: &lt;sage@redhat.com&gt;
Cc: &lt;sfrench@samba.org&gt;
Cc: &lt;swhiteho@redhat.com&gt;
Cc: &lt;tj@kernel.org&gt;
Cc: &lt;trond.myklebust@primarydata.com&gt;
Cc: &lt;tytso@mit.edu&gt;
Cc: &lt;viro@zeniv.linux.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
struct timespec is not y2038 safe. Transition vfs to use
y2038 safe struct timespec64 instead.

The change was made with the help of the following cocinelle
script. This catches about 80% of the changes.
All the header file and logic changes are included in the
first 5 rules. The rest are trivial substitutions.
I avoid changing any of the function signatures or any other
filesystem specific data structures to keep the patch simple
for review.

The script can be a little shorter by combining different cases.
But, this version was sufficient for my usecase.

virtual patch

@ depends on patch @
identifier now;
@@
- struct timespec
+ struct timespec64
  current_time ( ... )
  {
- struct timespec now = current_kernel_time();
+ struct timespec64 now = current_kernel_time64();
  ...
- return timespec_trunc(
+ return timespec64_trunc(
  ... );
  }

@ depends on patch @
identifier xtime;
@@
 struct \( iattr \| inode \| kstat \) {
 ...
-       struct timespec xtime;
+       struct timespec64 xtime;
 ...
 }

@ depends on patch @
identifier t;
@@
 struct inode_operations {
 ...
int (*update_time) (...,
-       struct timespec t,
+       struct timespec64 t,
...);
 ...
 }

@ depends on patch @
identifier t;
identifier fn_update_time =~ "update_time$";
@@
 fn_update_time (...,
- struct timespec *t,
+ struct timespec64 *t,
 ...) { ... }

@ depends on patch @
identifier t;
@@
lease_get_mtime( ... ,
- struct timespec *t
+ struct timespec64 *t
  ) { ... }

@te depends on patch forall@
identifier ts;
local idexpression struct inode *inode_node;
identifier i_xtime =~ "^i_[acm]time$";
identifier ia_xtime =~ "^ia_[acm]time$";
identifier fn_update_time =~ "update_time$";
identifier fn;
expression e, E3;
local idexpression struct inode *node1;
local idexpression struct inode *node2;
local idexpression struct iattr *attr1;
local idexpression struct iattr *attr2;
local idexpression struct iattr attr;
identifier i_xtime1 =~ "^i_[acm]time$";
identifier i_xtime2 =~ "^i_[acm]time$";
identifier ia_xtime1 =~ "^ia_[acm]time$";
identifier ia_xtime2 =~ "^ia_[acm]time$";
@@
(
(
- struct timespec ts;
+ struct timespec64 ts;
|
- struct timespec ts = current_time(inode_node);
+ struct timespec64 ts = current_time(inode_node);
)

&lt;+... when != ts
(
- timespec_equal(&amp;inode_node-&gt;i_xtime, &amp;ts)
+ timespec64_equal(&amp;inode_node-&gt;i_xtime, &amp;ts)
|
- timespec_equal(&amp;ts, &amp;inode_node-&gt;i_xtime)
+ timespec64_equal(&amp;ts, &amp;inode_node-&gt;i_xtime)
|
- timespec_compare(&amp;inode_node-&gt;i_xtime, &amp;ts)
+ timespec64_compare(&amp;inode_node-&gt;i_xtime, &amp;ts)
|
- timespec_compare(&amp;ts, &amp;inode_node-&gt;i_xtime)
+ timespec64_compare(&amp;ts, &amp;inode_node-&gt;i_xtime)
|
ts = current_time(e)
|
fn_update_time(..., &amp;ts,...)
|
inode_node-&gt;i_xtime = ts
|
node1-&gt;i_xtime = ts
|
ts = inode_node-&gt;i_xtime
|
&lt;+... attr1-&gt;ia_xtime ...+&gt; = ts
|
ts = attr1-&gt;ia_xtime
|
ts.tv_sec
|
ts.tv_nsec
|
btrfs_set_stack_timespec_sec(..., ts.tv_sec)
|
btrfs_set_stack_timespec_nsec(..., ts.tv_nsec)
|
- ts = timespec64_to_timespec(
+ ts =
...
-)
|
- ts = ktime_to_timespec(
+ ts = ktime_to_timespec64(
...)
|
- ts = E3
+ ts = timespec_to_timespec64(E3)
|
- ktime_get_real_ts(&amp;ts)
+ ktime_get_real_ts64(&amp;ts)
|
fn(...,
- ts
+ timespec64_to_timespec(ts)
,...)
)
...+&gt;
(
&lt;... when != ts
- return ts;
+ return timespec64_to_timespec(ts);
...&gt;
)
|
- timespec_equal(&amp;node1-&gt;i_xtime1, &amp;node2-&gt;i_xtime2)
+ timespec64_equal(&amp;node1-&gt;i_xtime2, &amp;node2-&gt;i_xtime2)
|
- timespec_equal(&amp;node1-&gt;i_xtime1, &amp;attr2-&gt;ia_xtime2)
+ timespec64_equal(&amp;node1-&gt;i_xtime2, &amp;attr2-&gt;ia_xtime2)
|
- timespec_compare(&amp;node1-&gt;i_xtime1, &amp;node2-&gt;i_xtime2)
+ timespec64_compare(&amp;node1-&gt;i_xtime1, &amp;node2-&gt;i_xtime2)
|
node1-&gt;i_xtime1 =
- timespec_trunc(attr1-&gt;ia_xtime1,
+ timespec64_trunc(attr1-&gt;ia_xtime1,
...)
|
- attr1-&gt;ia_xtime1 = timespec_trunc(attr2-&gt;ia_xtime2,
+ attr1-&gt;ia_xtime1 =  timespec64_trunc(attr2-&gt;ia_xtime2,
...)
|
- ktime_get_real_ts(&amp;attr1-&gt;ia_xtime1)
+ ktime_get_real_ts64(&amp;attr1-&gt;ia_xtime1)
|
- ktime_get_real_ts(&amp;attr.ia_xtime1)
+ ktime_get_real_ts64(&amp;attr.ia_xtime1)
)

@ depends on patch @
struct inode *node;
struct iattr *attr;
identifier fn;
identifier i_xtime =~ "^i_[acm]time$";
identifier ia_xtime =~ "^ia_[acm]time$";
expression e;
@@
(
- fn(node-&gt;i_xtime);
+ fn(timespec64_to_timespec(node-&gt;i_xtime));
|
 fn(...,
- node-&gt;i_xtime);
+ timespec64_to_timespec(node-&gt;i_xtime));
|
- e = fn(attr-&gt;ia_xtime);
+ e = fn(timespec64_to_timespec(attr-&gt;ia_xtime));
)

@ depends on patch forall @
struct inode *node;
struct iattr *attr;
identifier i_xtime =~ "^i_[acm]time$";
identifier ia_xtime =~ "^ia_[acm]time$";
identifier fn;
@@
{
+ struct timespec ts;
&lt;+...
(
+ ts = timespec64_to_timespec(node-&gt;i_xtime);
fn (...,
- &amp;node-&gt;i_xtime,
+ &amp;ts,
...);
|
+ ts = timespec64_to_timespec(attr-&gt;ia_xtime);
fn (...,
- &amp;attr-&gt;ia_xtime,
+ &amp;ts,
...);
)
...+&gt;
}

@ depends on patch forall @
struct inode *node;
struct iattr *attr;
struct kstat *stat;
identifier ia_xtime =~ "^ia_[acm]time$";
identifier i_xtime =~ "^i_[acm]time$";
identifier xtime =~ "^[acm]time$";
identifier fn, ret;
@@
{
+ struct timespec ts;
&lt;+...
(
+ ts = timespec64_to_timespec(node-&gt;i_xtime);
ret = fn (...,
- &amp;node-&gt;i_xtime,
+ &amp;ts,
...);
|
+ ts = timespec64_to_timespec(node-&gt;i_xtime);
ret = fn (...,
- &amp;node-&gt;i_xtime);
+ &amp;ts);
|
+ ts = timespec64_to_timespec(attr-&gt;ia_xtime);
ret = fn (...,
- &amp;attr-&gt;ia_xtime,
+ &amp;ts,
...);
|
+ ts = timespec64_to_timespec(attr-&gt;ia_xtime);
ret = fn (...,
- &amp;attr-&gt;ia_xtime);
+ &amp;ts);
|
+ ts = timespec64_to_timespec(stat-&gt;xtime);
ret = fn (...,
- &amp;stat-&gt;xtime);
+ &amp;ts);
)
...+&gt;
}

@ depends on patch @
struct inode *node;
struct inode *node2;
identifier i_xtime1 =~ "^i_[acm]time$";
identifier i_xtime2 =~ "^i_[acm]time$";
identifier i_xtime3 =~ "^i_[acm]time$";
struct iattr *attrp;
struct iattr *attrp2;
struct iattr attr ;
identifier ia_xtime1 =~ "^ia_[acm]time$";
identifier ia_xtime2 =~ "^ia_[acm]time$";
struct kstat *stat;
struct kstat stat1;
struct timespec64 ts;
identifier xtime =~ "^[acmb]time$";
expression e;
@@
(
( node-&gt;i_xtime2 \| attrp-&gt;ia_xtime2 \| attr.ia_xtime2 \) = node-&gt;i_xtime1  ;
|
 node-&gt;i_xtime2 = \( node2-&gt;i_xtime1 \| timespec64_trunc(...) \);
|
 node-&gt;i_xtime2 = node-&gt;i_xtime1 = node-&gt;i_xtime3 = \(ts \| current_time(...) \);
|
 node-&gt;i_xtime1 = node-&gt;i_xtime3 = \(ts \| current_time(...) \);
|
 stat-&gt;xtime = node2-&gt;i_xtime1;
|
 stat1.xtime = node2-&gt;i_xtime1;
|
( node-&gt;i_xtime2 \| attrp-&gt;ia_xtime2 \) = attrp-&gt;ia_xtime1  ;
|
( attrp-&gt;ia_xtime1 \| attr.ia_xtime1 \) = attrp2-&gt;ia_xtime2;
|
- e = node-&gt;i_xtime1;
+ e = timespec64_to_timespec( node-&gt;i_xtime1 );
|
- e = attrp-&gt;ia_xtime1;
+ e = timespec64_to_timespec( attrp-&gt;ia_xtime1 );
|
node-&gt;i_xtime1 = current_time(...);
|
 node-&gt;i_xtime2 = node-&gt;i_xtime1 = node-&gt;i_xtime3 =
- e;
+ timespec_to_timespec64(e);
|
 node-&gt;i_xtime1 = node-&gt;i_xtime3 =
- e;
+ timespec_to_timespec64(e);
|
- node-&gt;i_xtime1 = e;
+ node-&gt;i_xtime1 = timespec_to_timespec64(e);
)

Signed-off-by: Deepa Dinamani &lt;deepa.kernel@gmail.com&gt;
Cc: &lt;anton@tuxera.com&gt;
Cc: &lt;balbi@kernel.org&gt;
Cc: &lt;bfields@fieldses.org&gt;
Cc: &lt;darrick.wong@oracle.com&gt;
Cc: &lt;dhowells@redhat.com&gt;
Cc: &lt;dsterba@suse.com&gt;
Cc: &lt;dwmw2@infradead.org&gt;
Cc: &lt;hch@lst.de&gt;
Cc: &lt;hirofumi@mail.parknet.co.jp&gt;
Cc: &lt;hubcap@omnibond.com&gt;
Cc: &lt;jack@suse.com&gt;
Cc: &lt;jaegeuk@kernel.org&gt;
Cc: &lt;jaharkes@cs.cmu.edu&gt;
Cc: &lt;jslaby@suse.com&gt;
Cc: &lt;keescook@chromium.org&gt;
Cc: &lt;mark@fasheh.com&gt;
Cc: &lt;miklos@szeredi.hu&gt;
Cc: &lt;nico@linaro.org&gt;
Cc: &lt;reiserfs-devel@vger.kernel.org&gt;
Cc: &lt;richard@nod.at&gt;
Cc: &lt;sage@redhat.com&gt;
Cc: &lt;sfrench@samba.org&gt;
Cc: &lt;swhiteho@redhat.com&gt;
Cc: &lt;tj@kernel.org&gt;
Cc: &lt;trond.myklebust@primarydata.com&gt;
Cc: &lt;tytso@mit.edu&gt;
Cc: &lt;viro@zeniv.linux.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>tty: Don't call panic() at tty_ldisc_init()</title>
<updated>2018-04-23T09:05:52+00:00</updated>
<author>
<name>Tetsuo Handa</name>
<email>penguin-kernel@I-love.SAKURA.ne.jp</email>
</author>
<published>2018-04-05T10:40:16+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=903f9db10f18f735e62ba447147b6c434b6af003'/>
<id>903f9db10f18f735e62ba447147b6c434b6af003</id>
<content type='text'>
syzbot is reporting kernel panic [1] triggered by memory allocation failure
at tty_ldisc_get() from tty_ldisc_init(). But since both tty_ldisc_get()
and caller of tty_ldisc_init() can cleanly handle errors, tty_ldisc_init()
does not need to call panic() when tty_ldisc_get() failed.

[1] https://syzkaller.appspot.com/bug?id=883431818e036ae6a9981156a64b821110f39187

Signed-off-by: Tetsuo Handa &lt;penguin-kernel@I-love.SAKURA.ne.jp&gt;
Reported-by: syzbot &lt;syzkaller@googlegroups.com&gt;
Cc: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
Cc: Jiri Slaby &lt;jslaby@suse.com&gt;
Cc: stable &lt;stable@vger.kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
syzbot is reporting kernel panic [1] triggered by memory allocation failure
at tty_ldisc_get() from tty_ldisc_init(). But since both tty_ldisc_get()
and caller of tty_ldisc_init() can cleanly handle errors, tty_ldisc_init()
does not need to call panic() when tty_ldisc_get() failed.

[1] https://syzkaller.appspot.com/bug?id=883431818e036ae6a9981156a64b821110f39187

Signed-off-by: Tetsuo Handa &lt;penguin-kernel@I-love.SAKURA.ne.jp&gt;
Reported-by: syzbot &lt;syzkaller@googlegroups.com&gt;
Cc: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
Cc: Jiri Slaby &lt;jslaby@suse.com&gt;
Cc: stable &lt;stable@vger.kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>tty: make n_tty_read() always abort if hangup is in progress</title>
<updated>2018-02-28T12:21:10+00:00</updated>
<author>
<name>Tejun Heo</name>
<email>tj@kernel.org</email>
</author>
<published>2018-02-13T15:38:08+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=28b0f8a6962a24ed21737578f3b1b07424635c9e'/>
<id>28b0f8a6962a24ed21737578f3b1b07424635c9e</id>
<content type='text'>
A tty is hung up by __tty_hangup() setting file-&gt;f_op to
hung_up_tty_fops, which is skipped on ttys whose write operation isn't
tty_write().  This means that, for example, /dev/console whose write
op is redirected_tty_write() is never actually marked hung up.

Because n_tty_read() uses the hung up status to decide whether to
abort the waiting readers, the lack of hung-up marking can lead to the
following scenario.

 1. A session contains two processes.  The leader and its child.  The
    child ignores SIGHUP.

 2. The leader exits and starts disassociating from the controlling
    terminal (/dev/console).

 3. __tty_hangup() skips setting f_op to hung_up_tty_fops.

 4. SIGHUP is delivered and ignored.

 5. tty_ldisc_hangup() is invoked.  It wakes up the waits which should
    clear the read lockers of tty-&gt;ldisc_sem.

 6. The reader wakes up but because tty_hung_up_p() is false, it
    doesn't abort and goes back to sleep while read-holding
    tty-&gt;ldisc_sem.

 7. The leader progresses to tty_ldisc_lock() in tty_ldisc_hangup()
    and is now stuck in D sleep indefinitely waiting for
    tty-&gt;ldisc_sem.

The following is Alan's explanation on why some ttys aren't hung up.

 http://lkml.kernel.org/r/20171101170908.6ad08580@alans-desktop

 1. It broke the serial consoles because they would hang up and close
    down the hardware. With tty_port that *should* be fixable properly
    for any cases remaining.

 2. The console layer was (and still is) completely broken and doens't
    refcount properly. So if you turn on console hangups it breaks (as
    indeed does freeing consoles and half a dozen other things).

As neither can be fixed quickly, this patch works around the problem
by introducing a new flag, TTY_HUPPING, which is used solely to tell
n_tty_read() that hang-up is in progress for the console and the
readers should be aborted regardless of the hung-up status of the
device.

The following is a sample hung task warning caused by this issue.

  INFO: task agetty:2662 blocked for more than 120 seconds.
        Not tainted 4.11.3-dbg-tty-lockup-02478-gfd6c7ee-dirty #28
  "echo 0 &gt; /proc/sys/kernel/hung_task_timeout_secs" disables this message.
      0  2662      1 0x00000086
  Call Trace:
   __schedule+0x267/0x890
   schedule+0x36/0x80
   schedule_timeout+0x23c/0x2e0
   ldsem_down_write+0xce/0x1f6
   tty_ldisc_lock+0x16/0x30
   tty_ldisc_hangup+0xb3/0x1b0
   __tty_hangup+0x300/0x410
   disassociate_ctty+0x6c/0x290
   do_exit+0x7ef/0xb00
   do_group_exit+0x3f/0xa0
   get_signal+0x1b3/0x5d0
   do_signal+0x28/0x660
   exit_to_usermode_loop+0x46/0x86
   do_syscall_64+0x9c/0xb0
   entry_SYSCALL64_slow_path+0x25/0x25

The following is the repro.  Run "$PROG /dev/console".  The parent
process hangs in D state.

  #include &lt;sys/types.h&gt;
  #include &lt;sys/stat.h&gt;
  #include &lt;sys/wait.h&gt;
  #include &lt;sys/ioctl.h&gt;
  #include &lt;fcntl.h&gt;
  #include &lt;unistd.h&gt;
  #include &lt;stdio.h&gt;
  #include &lt;stdlib.h&gt;
  #include &lt;errno.h&gt;
  #include &lt;signal.h&gt;
  #include &lt;time.h&gt;
  #include &lt;termios.h&gt;

  int main(int argc, char **argv)
  {
	  struct sigaction sact = { .sa_handler = SIG_IGN };
	  struct timespec ts1s = { .tv_sec = 1 };
	  pid_t pid;
	  int fd;

	  if (argc &lt; 2) {
		  fprintf(stderr, "test-hung-tty /dev/$TTY\n");
		  return 1;
	  }

	  /* fork a child to ensure that it isn't already the session leader */
	  pid = fork();
	  if (pid &lt; 0) {
		  perror("fork");
		  return 1;
	  }

	  if (pid &gt; 0) {
		  /* top parent, wait for everyone */
		  while (waitpid(-1, NULL, 0) &gt;= 0)
			  ;
		  if (errno != ECHILD)
			  perror("waitpid");
		  return 0;
	  }

	  /* new session, start a new session and set the controlling tty */
	  if (setsid() &lt; 0) {
		  perror("setsid");
		  return 1;
	  }

	  fd = open(argv[1], O_RDWR);
	  if (fd &lt; 0) {
		  perror("open");
		  return 1;
	  }

	  if (ioctl(fd, TIOCSCTTY, 1) &lt; 0) {
		  perror("ioctl");
		  return 1;
	  }

	  /* fork a child, sleep a bit and exit */
	  pid = fork();
	  if (pid &lt; 0) {
		  perror("fork");
		  return 1;
	  }

	  if (pid &gt; 0) {
		  nanosleep(&amp;ts1s, NULL);
		  printf("Session leader exiting\n");
		  exit(0);
	  }

	  /*
	   * The child ignores SIGHUP and keeps reading from the controlling
	   * tty.  Because SIGHUP is ignored, the child doesn't get killed on
	   * parent exit and the bug in n_tty makes the read(2) block the
	   * parent's control terminal hangup attempt.  The parent ends up in
	   * D sleep until the child is explicitly killed.
	   */
	  sigaction(SIGHUP, &amp;sact, NULL);
	  printf("Child reading tty\n");
	  while (1) {
		  char buf[1024];

		  if (read(fd, buf, sizeof(buf)) &lt; 0) {
			  perror("read");
			  return 1;
		  }
	  }

	  return 0;
  }

Signed-off-by: Tejun Heo &lt;tj@kernel.org&gt;
Cc: Alan Cox &lt;alan@llwyncelyn.cymru&gt;
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
A tty is hung up by __tty_hangup() setting file-&gt;f_op to
hung_up_tty_fops, which is skipped on ttys whose write operation isn't
tty_write().  This means that, for example, /dev/console whose write
op is redirected_tty_write() is never actually marked hung up.

Because n_tty_read() uses the hung up status to decide whether to
abort the waiting readers, the lack of hung-up marking can lead to the
following scenario.

 1. A session contains two processes.  The leader and its child.  The
    child ignores SIGHUP.

 2. The leader exits and starts disassociating from the controlling
    terminal (/dev/console).

 3. __tty_hangup() skips setting f_op to hung_up_tty_fops.

 4. SIGHUP is delivered and ignored.

 5. tty_ldisc_hangup() is invoked.  It wakes up the waits which should
    clear the read lockers of tty-&gt;ldisc_sem.

 6. The reader wakes up but because tty_hung_up_p() is false, it
    doesn't abort and goes back to sleep while read-holding
    tty-&gt;ldisc_sem.

 7. The leader progresses to tty_ldisc_lock() in tty_ldisc_hangup()
    and is now stuck in D sleep indefinitely waiting for
    tty-&gt;ldisc_sem.

The following is Alan's explanation on why some ttys aren't hung up.

 http://lkml.kernel.org/r/20171101170908.6ad08580@alans-desktop

 1. It broke the serial consoles because they would hang up and close
    down the hardware. With tty_port that *should* be fixable properly
    for any cases remaining.

 2. The console layer was (and still is) completely broken and doens't
    refcount properly. So if you turn on console hangups it breaks (as
    indeed does freeing consoles and half a dozen other things).

As neither can be fixed quickly, this patch works around the problem
by introducing a new flag, TTY_HUPPING, which is used solely to tell
n_tty_read() that hang-up is in progress for the console and the
readers should be aborted regardless of the hung-up status of the
device.

The following is a sample hung task warning caused by this issue.

  INFO: task agetty:2662 blocked for more than 120 seconds.
        Not tainted 4.11.3-dbg-tty-lockup-02478-gfd6c7ee-dirty #28
  "echo 0 &gt; /proc/sys/kernel/hung_task_timeout_secs" disables this message.
      0  2662      1 0x00000086
  Call Trace:
   __schedule+0x267/0x890
   schedule+0x36/0x80
   schedule_timeout+0x23c/0x2e0
   ldsem_down_write+0xce/0x1f6
   tty_ldisc_lock+0x16/0x30
   tty_ldisc_hangup+0xb3/0x1b0
   __tty_hangup+0x300/0x410
   disassociate_ctty+0x6c/0x290
   do_exit+0x7ef/0xb00
   do_group_exit+0x3f/0xa0
   get_signal+0x1b3/0x5d0
   do_signal+0x28/0x660
   exit_to_usermode_loop+0x46/0x86
   do_syscall_64+0x9c/0xb0
   entry_SYSCALL64_slow_path+0x25/0x25

The following is the repro.  Run "$PROG /dev/console".  The parent
process hangs in D state.

  #include &lt;sys/types.h&gt;
  #include &lt;sys/stat.h&gt;
  #include &lt;sys/wait.h&gt;
  #include &lt;sys/ioctl.h&gt;
  #include &lt;fcntl.h&gt;
  #include &lt;unistd.h&gt;
  #include &lt;stdio.h&gt;
  #include &lt;stdlib.h&gt;
  #include &lt;errno.h&gt;
  #include &lt;signal.h&gt;
  #include &lt;time.h&gt;
  #include &lt;termios.h&gt;

  int main(int argc, char **argv)
  {
	  struct sigaction sact = { .sa_handler = SIG_IGN };
	  struct timespec ts1s = { .tv_sec = 1 };
	  pid_t pid;
	  int fd;

	  if (argc &lt; 2) {
		  fprintf(stderr, "test-hung-tty /dev/$TTY\n");
		  return 1;
	  }

	  /* fork a child to ensure that it isn't already the session leader */
	  pid = fork();
	  if (pid &lt; 0) {
		  perror("fork");
		  return 1;
	  }

	  if (pid &gt; 0) {
		  /* top parent, wait for everyone */
		  while (waitpid(-1, NULL, 0) &gt;= 0)
			  ;
		  if (errno != ECHILD)
			  perror("waitpid");
		  return 0;
	  }

	  /* new session, start a new session and set the controlling tty */
	  if (setsid() &lt; 0) {
		  perror("setsid");
		  return 1;
	  }

	  fd = open(argv[1], O_RDWR);
	  if (fd &lt; 0) {
		  perror("open");
		  return 1;
	  }

	  if (ioctl(fd, TIOCSCTTY, 1) &lt; 0) {
		  perror("ioctl");
		  return 1;
	  }

	  /* fork a child, sleep a bit and exit */
	  pid = fork();
	  if (pid &lt; 0) {
		  perror("fork");
		  return 1;
	  }

	  if (pid &gt; 0) {
		  nanosleep(&amp;ts1s, NULL);
		  printf("Session leader exiting\n");
		  exit(0);
	  }

	  /*
	   * The child ignores SIGHUP and keeps reading from the controlling
	   * tty.  Because SIGHUP is ignored, the child doesn't get killed on
	   * parent exit and the bug in n_tty makes the read(2) block the
	   * parent's control terminal hangup attempt.  The parent ends up in
	   * D sleep until the child is explicitly killed.
	   */
	  sigaction(SIGHUP, &amp;sact, NULL);
	  printf("Child reading tty\n");
	  while (1) {
		  char buf[1024];

		  if (read(fd, buf, sizeof(buf)) &lt; 0) {
			  perror("read");
			  return 1;
		  }
	  }

	  return 0;
  }

Signed-off-by: Tejun Heo &lt;tj@kernel.org&gt;
Cc: Alan Cox &lt;alan@llwyncelyn.cymru&gt;
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>vfs: do bulk POLL* -&gt; EPOLL* replacement</title>
<updated>2018-02-11T22:34:03+00:00</updated>
<author>
<name>Linus Torvalds</name>
<email>torvalds@linux-foundation.org</email>
</author>
<published>2018-02-11T22:34:03+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=a9a08845e9acbd224e4ee466f5c1275ed50054e8'/>
<id>a9a08845e9acbd224e4ee466f5c1275ed50054e8</id>
<content type='text'>
This is the mindless scripted replacement of kernel use of POLL*
variables as described by Al, done by this script:

    for V in IN OUT PRI ERR RDNORM RDBAND WRNORM WRBAND HUP RDHUP NVAL MSG; do
        L=`git grep -l -w POLL$V | grep -v '^t' | grep -v /um/ | grep -v '^sa' | grep -v '/poll.h$'|grep -v '^D'`
        for f in $L; do sed -i "-es/^\([^\"]*\)\(\&lt;POLL$V\&gt;\)/\\1E\\2/" $f; done
    done

with de-mangling cleanups yet to come.

NOTE! On almost all architectures, the EPOLL* constants have the same
values as the POLL* constants do.  But they keyword here is "almost".
For various bad reasons they aren't the same, and epoll() doesn't
actually work quite correctly in some cases due to this on Sparc et al.

The next patch from Al will sort out the final differences, and we
should be all done.

Scripted-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This is the mindless scripted replacement of kernel use of POLL*
variables as described by Al, done by this script:

    for V in IN OUT PRI ERR RDNORM RDBAND WRNORM WRBAND HUP RDHUP NVAL MSG; do
        L=`git grep -l -w POLL$V | grep -v '^t' | grep -v /um/ | grep -v '^sa' | grep -v '/poll.h$'|grep -v '^D'`
        for f in $L; do sed -i "-es/^\([^\"]*\)\(\&lt;POLL$V\&gt;\)/\\1E\\2/" $f; done
    done

with de-mangling cleanups yet to come.

NOTE! On almost all architectures, the EPOLL* constants have the same
values as the POLL* constants do.  But they keyword here is "almost".
For various bad reasons they aren't the same, and epoll() doesn't
actually work quite correctly in some cases due to this on Sparc et al.

The next patch from Al will sort out the final differences, and we
should be all done.

Scripted-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge tag 'tty-4.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty</title>
<updated>2018-02-01T17:46:00+00:00</updated>
<author>
<name>Linus Torvalds</name>
<email>torvalds@linux-foundation.org</email>
</author>
<published>2018-02-01T17:46:00+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=db5933225f2fe50d3b91ebbba73ed9c3b703b99a'/>
<id>db5933225f2fe50d3b91ebbba73ed9c3b703b99a</id>
<content type='text'>
Pull tty/staging driver updates from Greg KH:
 "Here is the big tty/serial driver update for 4.16-rc1.

  The usual number of various serial driver fixes and updates to try to
  get them to work with crazy hardware configurations (seriously, how
  many different ways are hardware engineers going to come up with to
  hook up a simple UART?)

  There is also some serdev bugfixes and updates, as well as a
  smattering of other small fixes in here.

  All have been in the linux-next tree for a while, with no reported
  issues"

* tag 'tty-4.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (65 commits)
  tty: serial: exar: Relocate sleep wake-up handling
  tty: fix data race between tty_init_dev and flush of buf
  serial: imx: fix endless loop during suspend
  serial: core: mark port as initialized after successful IRQ change
  serdev: only match serdev devices
  serdev: do not generate modaliases for controllers
  serial: mxs-auart: don't use GPIOF_* with gpiod_get_direction
  serial: 8250_dw: Revert "Improve clock rate setting"
  MAINTAINERS: Add myself as designated reviewer for 8250_dw
  gpio: serial: max310x: Support open-drain configuration for GPIOs
  serdev: Fix serdev_uevent failure on ACPI enumerated serdev-controllers
  serial: 8250_ingenic: Parse earlycon options
  serial: 8250_ingenic: Add support for the JZ4770 SoC
  serial: core: Make uart_parse_options take const char* argument
  serial: 8250_of: fix return code when probe function fails to get reset
  serial: imx: Only wakeup via RTSDEN bit if the system has RTS/CTS
  serial: 8250_uniphier: fix error return code in uniphier_uart_probe()
  tty: n_gsm: Allow ADM response in addition to UA for control dlci
  tty: omap-serial: Fix initial on-boot RTS GPIO level
  tty: serial: jsm: Add one check against NULL pointer dereference
  ...
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Pull tty/staging driver updates from Greg KH:
 "Here is the big tty/serial driver update for 4.16-rc1.

  The usual number of various serial driver fixes and updates to try to
  get them to work with crazy hardware configurations (seriously, how
  many different ways are hardware engineers going to come up with to
  hook up a simple UART?)

  There is also some serdev bugfixes and updates, as well as a
  smattering of other small fixes in here.

  All have been in the linux-next tree for a while, with no reported
  issues"

* tag 'tty-4.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (65 commits)
  tty: serial: exar: Relocate sleep wake-up handling
  tty: fix data race between tty_init_dev and flush of buf
  serial: imx: fix endless loop during suspend
  serial: core: mark port as initialized after successful IRQ change
  serdev: only match serdev devices
  serdev: do not generate modaliases for controllers
  serial: mxs-auart: don't use GPIOF_* with gpiod_get_direction
  serial: 8250_dw: Revert "Improve clock rate setting"
  MAINTAINERS: Add myself as designated reviewer for 8250_dw
  gpio: serial: max310x: Support open-drain configuration for GPIOs
  serdev: Fix serdev_uevent failure on ACPI enumerated serdev-controllers
  serial: 8250_ingenic: Parse earlycon options
  serial: 8250_ingenic: Add support for the JZ4770 SoC
  serial: core: Make uart_parse_options take const char* argument
  serial: 8250_of: fix return code when probe function fails to get reset
  serial: imx: Only wakeup via RTSDEN bit if the system has RTS/CTS
  serial: 8250_uniphier: fix error return code in uniphier_uart_probe()
  tty: n_gsm: Allow ADM response in addition to UA for control dlci
  tty: omap-serial: Fix initial on-boot RTS GPIO level
  tty: serial: jsm: Add one check against NULL pointer dereference
  ...
</pre>
</div>
</content>
</entry>
<entry>
<title>tty: fix data race between tty_init_dev and flush of buf</title>
<updated>2018-01-23T07:57:37+00:00</updated>
<author>
<name>Gaurav Kohli</name>
<email>gkohli@codeaurora.org</email>
</author>
<published>2018-01-23T07:46:34+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=b027e2298bd588d6fa36ed2eda97447fb3eac078'/>
<id>b027e2298bd588d6fa36ed2eda97447fb3eac078</id>
<content type='text'>
There can be a race, if receive_buf call comes before
tty initialization completes in n_tty_open and tty-&gt;disc_data
may be NULL.

CPU0					CPU1
----					----
 000|n_tty_receive_buf_common()   	n_tty_open()
-001|n_tty_receive_buf2()		tty_ldisc_open.isra.3()
-002|tty_ldisc_receive_buf(inline)	tty_ldisc_setup()

Using ldisc semaphore lock in tty_init_dev till disc_data
initializes completely.

Signed-off-by: Gaurav Kohli &lt;gkohli@codeaurora.org&gt;
Reviewed-by: Alan Cox &lt;alan@linux.intel.com&gt;
Cc: stable &lt;stable@vger.kernel.org&gt;

Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
There can be a race, if receive_buf call comes before
tty initialization completes in n_tty_open and tty-&gt;disc_data
may be NULL.

CPU0					CPU1
----					----
 000|n_tty_receive_buf_common()   	n_tty_open()
-001|n_tty_receive_buf2()		tty_ldisc_open.isra.3()
-002|tty_ldisc_receive_buf(inline)	tty_ldisc_setup()

Using ldisc semaphore lock in tty_init_dev till disc_data
initializes completely.

Signed-off-by: Gaurav Kohli &lt;gkohli@codeaurora.org&gt;
Reviewed-by: Alan Cox &lt;alan@linux.intel.com&gt;
Cc: stable &lt;stable@vger.kernel.org&gt;

Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>pty: cancel pty slave port buf's work in tty_release</title>
<updated>2017-12-19T08:59:51+00:00</updated>
<author>
<name>Sahara</name>
<email>keun-o.park@darkmatter.ae</email>
</author>
<published>2017-12-13T05:10:48+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=2b022ab7542df60021ab57854b3faaaf42552eaf'/>
<id>2b022ab7542df60021ab57854b3faaaf42552eaf</id>
<content type='text'>
In case that CONFIG_SLUB_DEBUG is on and pty is used, races between
release_one_tty and flush_to_ldisc work threads may happen and lead
to use-after-free condition on tty-&gt;link-&gt;port. Because SLUB_DEBUG
is turned on, freed tty-&gt;link-&gt;port is filled with POISON_FREE value.
So far without SLUB_DEBUG, port was filled with zero and flush_to_ldisc
could return without a problem by checking if tty is NULL.

CPU 0                                 CPU 1
-----                                 -----
release_tty                           pty_write
   cancel_work_sync(tty)                 to = tty-&gt;link
   tty_kref_put(tty-&gt;link)               tty_schedule_flip(to-&gt;port)
      &lt;&lt; workqueue &gt;&gt;                 ...
      release_one_tty                 ...
         pty_cleanup                  ...
            kfree(tty-&gt;link-&gt;port)       &lt;&lt; workqueue &gt;&gt;
                                         flush_to_ldisc
                                            tty = READ_ONCE(port-&gt;itty)
                                            tty is 0x6b6b6b6b6b6b6b6b
                                            !!PANIC!! access tty-&gt;ldisc

 Unable to handle kernel paging request at virtual address 6b6b6b6b6b6b6b93
 pgd = ffffffc0eb1c3000
 [6b6b6b6b6b6b6b93] *pgd=0000000000000000, *pud=0000000000000000
 ------------[ cut here ]------------
 Kernel BUG at ffffff800851154c [verbose debug info unavailable]
 Internal error: Oops - BUG: 96000004 [#1] PREEMPT SMP
 CPU: 3 PID: 265 Comm: kworker/u8:9 Tainted: G        W 3.18.31-g0a58eeb #1
 Hardware name: Qualcomm Technologies, Inc. MSM 8996pro v1.1 + PMI8996 Carbide (DT)
 Workqueue: events_unbound flush_to_ldisc
 task: ffffffc0ed610ec0 ti: ffffffc0ed624000 task.ti: ffffffc0ed624000
 PC is at ldsem_down_read_trylock+0x0/0x4c
 LR is at tty_ldisc_ref+0x24/0x4c
 pc : [&lt;ffffff800851154c&gt;] lr : [&lt;ffffff800850f6c0&gt;] pstate: 80400145
 sp : ffffffc0ed627cd0
 x29: ffffffc0ed627cd0 x28: 0000000000000000
 x27: ffffff8009e05000 x26: ffffffc0d382cfa0
 x25: 0000000000000000 x24: ffffff800a012f08
 x23: 0000000000000000 x22: ffffffc0703fbc88
 x21: 6b6b6b6b6b6b6b6b x20: 6b6b6b6b6b6b6b93
 x19: 0000000000000000 x18: 0000000000000001
 x17: 00e80000f80d6f53 x16: 0000000000000001
 x15: 0000007f7d826fff x14: 00000000000000a0
 x13: 0000000000000000 x12: 0000000000000109
 x11: 0000000000000000 x10: 0000000000000000
 x9 : ffffffc0ed624000 x8 : ffffffc0ed611580
 x7 : 0000000000000000 x6 : ffffff800a42e000
 x5 : 00000000000003fc x4 : 0000000003bd1201
 x3 : 0000000000000001 x2 : 0000000000000001
 x1 : ffffff800851004c x0 : 6b6b6b6b6b6b6b93

Signed-off-by: Sahara &lt;keun-o.park@darkmatter.ae&gt;

Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
In case that CONFIG_SLUB_DEBUG is on and pty is used, races between
release_one_tty and flush_to_ldisc work threads may happen and lead
to use-after-free condition on tty-&gt;link-&gt;port. Because SLUB_DEBUG
is turned on, freed tty-&gt;link-&gt;port is filled with POISON_FREE value.
So far without SLUB_DEBUG, port was filled with zero and flush_to_ldisc
could return without a problem by checking if tty is NULL.

CPU 0                                 CPU 1
-----                                 -----
release_tty                           pty_write
   cancel_work_sync(tty)                 to = tty-&gt;link
   tty_kref_put(tty-&gt;link)               tty_schedule_flip(to-&gt;port)
      &lt;&lt; workqueue &gt;&gt;                 ...
      release_one_tty                 ...
         pty_cleanup                  ...
            kfree(tty-&gt;link-&gt;port)       &lt;&lt; workqueue &gt;&gt;
                                         flush_to_ldisc
                                            tty = READ_ONCE(port-&gt;itty)
                                            tty is 0x6b6b6b6b6b6b6b6b
                                            !!PANIC!! access tty-&gt;ldisc

 Unable to handle kernel paging request at virtual address 6b6b6b6b6b6b6b93
 pgd = ffffffc0eb1c3000
 [6b6b6b6b6b6b6b93] *pgd=0000000000000000, *pud=0000000000000000
 ------------[ cut here ]------------
 Kernel BUG at ffffff800851154c [verbose debug info unavailable]
 Internal error: Oops - BUG: 96000004 [#1] PREEMPT SMP
 CPU: 3 PID: 265 Comm: kworker/u8:9 Tainted: G        W 3.18.31-g0a58eeb #1
 Hardware name: Qualcomm Technologies, Inc. MSM 8996pro v1.1 + PMI8996 Carbide (DT)
 Workqueue: events_unbound flush_to_ldisc
 task: ffffffc0ed610ec0 ti: ffffffc0ed624000 task.ti: ffffffc0ed624000
 PC is at ldsem_down_read_trylock+0x0/0x4c
 LR is at tty_ldisc_ref+0x24/0x4c
 pc : [&lt;ffffff800851154c&gt;] lr : [&lt;ffffff800850f6c0&gt;] pstate: 80400145
 sp : ffffffc0ed627cd0
 x29: ffffffc0ed627cd0 x28: 0000000000000000
 x27: ffffff8009e05000 x26: ffffffc0d382cfa0
 x25: 0000000000000000 x24: ffffff800a012f08
 x23: 0000000000000000 x22: ffffffc0703fbc88
 x21: 6b6b6b6b6b6b6b6b x20: 6b6b6b6b6b6b6b93
 x19: 0000000000000000 x18: 0000000000000001
 x17: 00e80000f80d6f53 x16: 0000000000000001
 x15: 0000007f7d826fff x14: 00000000000000a0
 x13: 0000000000000000 x12: 0000000000000109
 x11: 0000000000000000 x10: 0000000000000000
 x9 : ffffffc0ed624000 x8 : ffffffc0ed611580
 x7 : 0000000000000000 x6 : ffffff800a42e000
 x5 : 00000000000003fc x4 : 0000000003bd1201
 x3 : 0000000000000001 x2 : 0000000000000001
 x1 : ffffff800851004c x0 : 6b6b6b6b6b6b6b93

Signed-off-by: Sahara &lt;keun-o.park@darkmatter.ae&gt;

Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>the rest of drivers/*: annotate -&gt;poll() instances</title>
<updated>2017-11-28T16:06:58+00:00</updated>
<author>
<name>Al Viro</name>
<email>viro@zeniv.linux.org.uk</email>
</author>
<published>2017-07-03T10:39:46+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=afc9a42b7464f76e1388cad87d8543c69f6f74ed'/>
<id>afc9a42b7464f76e1388cad87d8543c69f6f74ed</id>
<content type='text'>
Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>anntotate the places where -&gt;poll() return values go</title>
<updated>2017-11-27T21:19:53+00:00</updated>
<author>
<name>Al Viro</name>
<email>viro@zeniv.linux.org.uk</email>
</author>
<published>2017-07-04T02:25:56+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=e6c8adca20ba459dd88057ca74232bf9f1045075'/>
<id>e6c8adca20ba459dd88057ca74232bf9f1045075</id>
<content type='text'>
Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>tty: add SPDX identifiers to all remaining files in drivers/tty/</title>
<updated>2017-11-08T12:08:12+00:00</updated>
<author>
<name>Greg Kroah-Hartman</name>
<email>gregkh@linuxfoundation.org</email>
</author>
<published>2017-11-06T17:11:51+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=e3b3d0f549c1d19b94e6ac55c66643166ea649ef'/>
<id>e3b3d0f549c1d19b94e6ac55c66643166ea649ef</id>
<content type='text'>
It's good to have SPDX identifiers in all files to make it easier to
audit the kernel tree for correct licenses.

Update the drivers/tty files files with the correct SPDX license
identifier based on the license text in the file itself.  The SPDX
identifier is a legally binding shorthand, which can be used instead of
the full boiler plate text.

This work is based on a script and data from Thomas Gleixner, Philippe
Ombredanne, and Kate Stewart.

Cc: Jiri Slaby &lt;jslaby@suse.com&gt;
Cc: Benjamin Herrenschmidt &lt;benh@kernel.crashing.org&gt;
Cc: Paul Mackerras &lt;paulus@samba.org&gt;
Cc: Michael Ellerman &lt;mpe@ellerman.id.au&gt;
Cc: Chris Metcalf &lt;cmetcalf@mellanox.com&gt;
Cc: Jiri Kosina &lt;jikos@kernel.org&gt;
Cc: David Sterba &lt;dsterba@suse.com&gt;
Cc: James Hogan &lt;jhogan@kernel.org&gt;
Cc: Rob Herring &lt;robh@kernel.org&gt;
Cc: Eric Anholt &lt;eric@anholt.net&gt;
Cc: Stefan Wahren &lt;stefan.wahren@i2se.com&gt;
Cc: Florian Fainelli &lt;f.fainelli@gmail.com&gt;
Cc: Ray Jui &lt;rjui@broadcom.com&gt;
Cc: Scott Branden &lt;sbranden@broadcom.com&gt;
Cc: bcm-kernel-feedback-list@broadcom.com
Cc: "James E.J. Bottomley" &lt;jejb@parisc-linux.org&gt;
Cc: Helge Deller &lt;deller@gmx.de&gt;
Cc: Joachim Eastwood &lt;manabian@gmail.com&gt;
Cc: Matthias Brugger &lt;matthias.bgg@gmail.com&gt;
Cc: Masahiro Yamada &lt;yamada.masahiro@socionext.com&gt;
Cc: Tobias Klauser &lt;tklauser@distanz.ch&gt;
Cc: Russell King &lt;linux@armlinux.org.uk&gt;
Cc: Vineet Gupta &lt;vgupta@synopsys.com&gt;
Cc: Richard Genoud &lt;richard.genoud@gmail.com&gt;
Cc: Alexander Shiyan &lt;shc_work@mail.ru&gt;
Cc: Baruch Siach &lt;baruch@tkos.co.il&gt;
Cc: "Maciej W. Rozycki" &lt;macro@linux-mips.org&gt;
Cc: "Uwe Kleine-König" &lt;kernel@pengutronix.de&gt;
Cc: Pat Gefre &lt;pfg@sgi.com&gt;
Cc: "Guilherme G. Piccoli" &lt;gpiccoli@linux.vnet.ibm.com&gt;
Cc: Jason Wessel &lt;jason.wessel@windriver.com&gt;
Cc: Vladimir Zapolskiy &lt;vz@mleia.com&gt;
Cc: Sylvain Lemieux &lt;slemieux.tyco@gmail.com&gt;
Cc: Carlo Caione &lt;carlo@caione.org&gt;
Cc: Kevin Hilman &lt;khilman@baylibre.com&gt;
Cc: Liviu Dudau &lt;liviu.dudau@arm.com&gt;
Cc: Sudeep Holla &lt;sudeep.holla@arm.com&gt;
Cc: Lorenzo Pieralisi &lt;lorenzo.pieralisi@arm.com&gt;
Cc: Andy Gross &lt;andy.gross@linaro.org&gt;
Cc: David Brown &lt;david.brown@linaro.org&gt;
Cc: "Andreas Färber" &lt;afaerber@suse.de&gt;
Cc: Kevin Cernekee &lt;cernekee@gmail.com&gt;
Cc: Laxman Dewangan &lt;ldewangan@nvidia.com&gt;
Cc: Thierry Reding &lt;thierry.reding@gmail.com&gt;
Cc: Jonathan Hunter &lt;jonathanh@nvidia.com&gt;
Cc: Barry Song &lt;baohua@kernel.org&gt;
Cc: Patrice Chotard &lt;patrice.chotard@st.com&gt;
Cc: Maxime Coquelin &lt;mcoquelin.stm32@gmail.com&gt;
Cc: Alexandre Torgue &lt;alexandre.torgue@st.com&gt;
Cc: "David S. Miller" &lt;davem@davemloft.net&gt;
Cc: Peter Korsgaard &lt;jacmet@sunsite.dk&gt;
Cc: Timur Tabi &lt;timur@tabi.org&gt;
Cc: Tony Prisk &lt;linux@prisktech.co.nz&gt;
Cc: Michal Simek &lt;michal.simek@xilinx.com&gt;
Cc: "Sören Brinkmann" &lt;soren.brinkmann@xilinx.com&gt;
Cc: Thomas Gleixner &lt;tglx@linutronix.de&gt;
Cc: Kate Stewart &lt;kstewart@linuxfoundation.org&gt;
Cc: Philippe Ombredanne &lt;pombredanne@nexb.com&gt;
Cc: Jiri Slaby &lt;jslaby@suse.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
It's good to have SPDX identifiers in all files to make it easier to
audit the kernel tree for correct licenses.

Update the drivers/tty files files with the correct SPDX license
identifier based on the license text in the file itself.  The SPDX
identifier is a legally binding shorthand, which can be used instead of
the full boiler plate text.

This work is based on a script and data from Thomas Gleixner, Philippe
Ombredanne, and Kate Stewart.

Cc: Jiri Slaby &lt;jslaby@suse.com&gt;
Cc: Benjamin Herrenschmidt &lt;benh@kernel.crashing.org&gt;
Cc: Paul Mackerras &lt;paulus@samba.org&gt;
Cc: Michael Ellerman &lt;mpe@ellerman.id.au&gt;
Cc: Chris Metcalf &lt;cmetcalf@mellanox.com&gt;
Cc: Jiri Kosina &lt;jikos@kernel.org&gt;
Cc: David Sterba &lt;dsterba@suse.com&gt;
Cc: James Hogan &lt;jhogan@kernel.org&gt;
Cc: Rob Herring &lt;robh@kernel.org&gt;
Cc: Eric Anholt &lt;eric@anholt.net&gt;
Cc: Stefan Wahren &lt;stefan.wahren@i2se.com&gt;
Cc: Florian Fainelli &lt;f.fainelli@gmail.com&gt;
Cc: Ray Jui &lt;rjui@broadcom.com&gt;
Cc: Scott Branden &lt;sbranden@broadcom.com&gt;
Cc: bcm-kernel-feedback-list@broadcom.com
Cc: "James E.J. Bottomley" &lt;jejb@parisc-linux.org&gt;
Cc: Helge Deller &lt;deller@gmx.de&gt;
Cc: Joachim Eastwood &lt;manabian@gmail.com&gt;
Cc: Matthias Brugger &lt;matthias.bgg@gmail.com&gt;
Cc: Masahiro Yamada &lt;yamada.masahiro@socionext.com&gt;
Cc: Tobias Klauser &lt;tklauser@distanz.ch&gt;
Cc: Russell King &lt;linux@armlinux.org.uk&gt;
Cc: Vineet Gupta &lt;vgupta@synopsys.com&gt;
Cc: Richard Genoud &lt;richard.genoud@gmail.com&gt;
Cc: Alexander Shiyan &lt;shc_work@mail.ru&gt;
Cc: Baruch Siach &lt;baruch@tkos.co.il&gt;
Cc: "Maciej W. Rozycki" &lt;macro@linux-mips.org&gt;
Cc: "Uwe Kleine-König" &lt;kernel@pengutronix.de&gt;
Cc: Pat Gefre &lt;pfg@sgi.com&gt;
Cc: "Guilherme G. Piccoli" &lt;gpiccoli@linux.vnet.ibm.com&gt;
Cc: Jason Wessel &lt;jason.wessel@windriver.com&gt;
Cc: Vladimir Zapolskiy &lt;vz@mleia.com&gt;
Cc: Sylvain Lemieux &lt;slemieux.tyco@gmail.com&gt;
Cc: Carlo Caione &lt;carlo@caione.org&gt;
Cc: Kevin Hilman &lt;khilman@baylibre.com&gt;
Cc: Liviu Dudau &lt;liviu.dudau@arm.com&gt;
Cc: Sudeep Holla &lt;sudeep.holla@arm.com&gt;
Cc: Lorenzo Pieralisi &lt;lorenzo.pieralisi@arm.com&gt;
Cc: Andy Gross &lt;andy.gross@linaro.org&gt;
Cc: David Brown &lt;david.brown@linaro.org&gt;
Cc: "Andreas Färber" &lt;afaerber@suse.de&gt;
Cc: Kevin Cernekee &lt;cernekee@gmail.com&gt;
Cc: Laxman Dewangan &lt;ldewangan@nvidia.com&gt;
Cc: Thierry Reding &lt;thierry.reding@gmail.com&gt;
Cc: Jonathan Hunter &lt;jonathanh@nvidia.com&gt;
Cc: Barry Song &lt;baohua@kernel.org&gt;
Cc: Patrice Chotard &lt;patrice.chotard@st.com&gt;
Cc: Maxime Coquelin &lt;mcoquelin.stm32@gmail.com&gt;
Cc: Alexandre Torgue &lt;alexandre.torgue@st.com&gt;
Cc: "David S. Miller" &lt;davem@davemloft.net&gt;
Cc: Peter Korsgaard &lt;jacmet@sunsite.dk&gt;
Cc: Timur Tabi &lt;timur@tabi.org&gt;
Cc: Tony Prisk &lt;linux@prisktech.co.nz&gt;
Cc: Michal Simek &lt;michal.simek@xilinx.com&gt;
Cc: "Sören Brinkmann" &lt;soren.brinkmann@xilinx.com&gt;
Cc: Thomas Gleixner &lt;tglx@linutronix.de&gt;
Cc: Kate Stewart &lt;kstewart@linuxfoundation.org&gt;
Cc: Philippe Ombredanne &lt;pombredanne@nexb.com&gt;
Cc: Jiri Slaby &lt;jslaby@suse.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
</feed>
