Re: [PATCH] u_serial.c - Force destroy tty_port in gserial_free_port

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 10/09/2014 10:26 AM, Alan Stern wrote:
> On Thu, 9 Oct 2014, Andre Wolokita wrote:
> 
>>>>> Isn't this now a "use-after-free" issue?
>>>>>
>>>>
>>>> Are you referring to the subsequent call to wait event() on gs_closed()?
>>>
>>> Yes.
>>>
>>>> Testing the use-case with this patch applied seemed to work without any 
>>>> issues. The ttyGS0 reference in /dev/ is gone after running modprobe -r
>>>> but I'm just a newbie, so I could be doing sometime horrible here.
>>>
>>> Hm, I dug into the tty core, it should be ok, but it just seems really
>>> odd, and bad-form to be doing something with port->port after calling a
>>> "destroy" function with it, don't you agree?
>>
>> I do. The call to wait_event() can be removed as we no longer care whether
>> gs_closed(port) is returning true - if it even can, having destroyed the
>> tty_port.
> 
> Maybe you don't care whether gs_closed(port) returns true, but you 
> should care about whether gs_closed() crashes -- which it might well do 
> if it tries to access deallocated memory.
> 
> Did you test your patch by unloading the module while there were
> pending opens?

gs_closed() won't crash because that's not the memory being deallocated.
tty_port_destroy() is somewhat misnamed; should be more like tty_port_cleanup(),
as it doesn't actually deallocate the port (because tty_port could be an
embedded structure in a larger 'port' which is the most common usage).

I've been struggling to understand how this patch could even cause the
wait_event() to complete and the only thing I can hypothesize is that
the deallocation in tty_port_destroy() somehow causes the process with
the open tty to crash but I don't see how.

Regards,
Peter Hurley

PS - My earlier email was greylisted so that's why I appeared to reply
well after your answer :)

X-Greylist: delayed 4693 seconds by postgrey-1.27 at vger.kernel.org; Thu, 09 Oct 2014 11:06:05 EDT
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html




[Index of Archives]     [Linux Media]     [Linux Input]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [Old Linux USB Devel Archive]

  Powered by Linux