Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 057b82be authored by Amit Shah's avatar Amit Shah Committed by Rusty Russell
Browse files

virtio: console: fix race with port unplug and open/close 



There's a window between find_port_by_devt() returning a port and us
taking a kref on the port, where the port could get unplugged.  Fix it
by taking the reference in find_port_by_devt() itself.

Problem reported and analyzed by Mateusz Guzik.

CC: <stable@vger.kernel.org>
Reported-by: default avatarMateusz Guzik <mguzik@redhat.com>
Signed-off-by: default avatarAmit Shah <amit.shah@redhat.com>
Signed-off-by: default avatarRusty Russell <rusty@rustcorp.com.au>
parent 2b4fbf02

drivers/char/virtio_console.c

+6 −7
Original line number Diff line number Diff line
@@ -272,9 +272,12 @@ static struct port *find_port_by_devt_in_portdev(struct ports_device *portdev, 
	unsigned long flags;



	spin_lock_irqsave(&portdev->ports_lock, flags);

	list_for_each_entry(port, &portdev->ports, list)

		if (port->cdev->dev == dev)

	list_for_each_entry(port, &portdev->ports, list) {

		if (port->cdev->dev == dev) {

			kref_get(&port->kref);

			goto out;

		}

	}

	port = NULL;

out:

	spin_unlock_irqrestore(&portdev->ports_lock, flags);
@@ -1036,14 +1039,10 @@ static int port_fops_open(struct inode *inode, struct file *filp) 
	struct port *port;

	int ret;



	/* We get the port with a kref here */

	port = find_port_by_devt(cdev->dev);

	filp->private_data = port;



	/* Prevent against a port getting hot-unplugged at the same time */

	spin_lock_irq(&port->portdev->ports_lock);

	kref_get(&port->kref);

	spin_unlock_irq(&port->portdev->ports_lock);



	/*

	 * Don't allow opening of console port devices -- that's done

	 * via /dev/hvc