tty: hvc: Fix data abort due to race in hvc_open
authorRaghavendra Rao Ananta <rananta@codeaurora.org>
Tue, 28 Apr 2020 03:26:01 +0000 (20:26 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 24 Jun 2020 15:50:22 +0000 (17:50 +0200)
commit793e15fb6681d11f41293b9df251cfda752be6c7
treeb9185eb13bf33707d430460057b2823b3a4c2d4e
parenteb3e85b3375d9cab91a251044c57e8d8a3ccf74b
tty: hvc: Fix data abort due to race in hvc_open

[ Upstream commit e2bd1dcbe1aa34ff5570b3427c530e4332ecf0fe ]

Potentially, hvc_open() can be called in parallel when two tasks calls
open() on /dev/hvcX. In such a scenario, if the hp->ops->notifier_add()
callback in the function fails, where it sets the tty->driver_data to
NULL, the parallel hvc_open() can see this NULL and cause a memory abort.
Hence, serialize hvc_open and check if tty->private_data is NULL before
proceeding ahead.

The issue can be easily reproduced by launching two tasks simultaneously
that does nothing but open() and close() on /dev/hvcX.
For example:
$ ./simple_open_close /dev/hvc0 & ./simple_open_close /dev/hvc0 &

Signed-off-by: Raghavendra Rao Ananta <rananta@codeaurora.org>
Link: https://lore.kernel.org/r/20200428032601.22127-1-rananta@codeaurora.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/tty/hvc/hvc_console.c