This is a note to let you know that I've just added the patch titled Revert "tty: hvc: Fix data abort due to race in hvc_open" to the 5.4-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: revert-tty-hvc-fix-data-abort-due-to-race-in-hvc_open.patch and it can be found in the queue-5.4 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From cf9c94456ebafc6d75a834e58dfdc8ae71a3acbc Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> Date: Tue, 12 May 2020 10:22:44 +0200 Subject: Revert "tty: hvc: Fix data abort due to race in hvc_open" From: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> commit cf9c94456ebafc6d75a834e58dfdc8ae71a3acbc upstream. This reverts commit e2bd1dcbe1aa34ff5570b3427c530e4332ecf0fe. In discussion on the mailing list, it has been determined that this is not the correct type of fix for this issue. Revert it so that we can do this correctly. Reported-by: Jiri Slaby <jslaby@xxxxxxx> Reported-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> Link: https://lore.kernel.org/r/20200428032601.22127-1-rananta@xxxxxxxxxxxxxx Cc: Raghavendra Rao Ananta <rananta@xxxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/tty/hvc/hvc_console.c | 16 ++-------------- 1 file changed, 2 insertions(+), 14 deletions(-) --- a/drivers/tty/hvc/hvc_console.c +++ b/drivers/tty/hvc/hvc_console.c @@ -75,8 +75,6 @@ static LIST_HEAD(hvc_structs); */ static DEFINE_MUTEX(hvc_structs_mutex); -/* Mutex to serialize hvc_open */ -static DEFINE_MUTEX(hvc_open_mutex); /* * This value is used to assign a tty->index value to a hvc_struct based * upon order of exposure via hvc_probe(), when we can not match it to @@ -348,24 +346,16 @@ static int hvc_install(struct tty_driver */ static int hvc_open(struct tty_struct *tty, struct file * filp) { - struct hvc_struct *hp; + struct hvc_struct *hp = tty->driver_data; unsigned long flags; int rc = 0; - mutex_lock(&hvc_open_mutex); - - hp = tty->driver_data; - if (!hp) { - rc = -EIO; - goto out; - } - spin_lock_irqsave(&hp->port.lock, flags); /* Check and then increment for fast path open. */ if (hp->port.count++ > 0) { spin_unlock_irqrestore(&hp->port.lock, flags); hvc_kick(); - goto out; + return 0; } /* else count == 0 */ spin_unlock_irqrestore(&hp->port.lock, flags); @@ -393,8 +383,6 @@ static int hvc_open(struct tty_struct *t /* Force wakeup of the polling thread */ hvc_kick(); -out: - mutex_unlock(&hvc_open_mutex); return rc; } Patches currently in stable-queue which might be from gregkh@xxxxxxxxxxxxxxxxxxx are queue-5.4/xhci-fix-incorrect-ep_state_mask.patch queue-5.4/xhci-fix-enumeration-issue-when-setting-max-packet-size-for-fs-devices.patch queue-5.4/cifs-smb3-fix-data-inconsistent-when-zero-file-range.patch queue-5.4/mld-fix-memory-leak-in-ipv6_mc_destroy_dev.patch queue-5.4/nfsv4-fix-close-not-waiting-for-direct-io-compeletion.patch queue-5.4/alsa-usb-audio-add-quirk-for-denon-dcd-1500re.patch queue-5.4/x86-asm-64-align-start-of-__clear_user-loop-to-16-bytes.patch queue-5.4/net-fix-memleak-in-register_netdevice.patch queue-5.4/cifs-smb3-fix-data-inconsistent-when-punch-hole.patch queue-5.4/xhci-return-if-xhci-doesn-t-support-lpm.patch queue-5.4/usb-cdns3-ep0-add-spinlock-for-cdns3_check_new_setup.patch queue-5.4/tg3-driver-sleeps-indefinitely-when-eeh-errors-exceed-eeh_max_freezes.patch queue-5.4/usb-ohci-sm501-add-missed-iounmap-in-remove.patch queue-5.4/net-do-not-clear-the-sock-tx-queue-in-sk_set_socket.patch queue-5.4/ib-mad-fix-use-after-free-when-destroying-mad-agent.patch queue-5.4/drm-amdgpu-add-fw-release-for-sdma-v5_0.patch queue-5.4/net-fix-the-arp-error-in-some-cases.patch queue-5.4/rxrpc-fix-notification-call-on-completion-of-discarded-calls.patch queue-5.4/arm64-dts-imx8mm-evk-correct-ldo1-ldo2-voltage-range.patch queue-5.4/ocfs2-fix-value-of-ocfs2_invalid_slot.patch queue-5.4/scsi-qla2xxx-keep-initiator-ports-after-rscn.patch queue-5.4/mvpp2-ethtool-rxtx-stats-fix.patch queue-5.4/net-usb-ax88179_178a-fix-packet-alignment-padding.patch queue-5.4/geneve-allow-changing-df-behavior-after-creation.patch queue-5.4/sctp-don-t-advertise-ipv4-addresses-if-ipv6only-is-set-on-the-socket.patch queue-5.4/cifs-fix-cached_fid-refcnt-leak-in-open_shroot.patch queue-5.4/alsa-usb-audio-add-quirk-for-samsung-usbc-headset-akg.patch queue-5.4/net-core-reduce-recursion-limit-value.patch queue-5.4/staging-rtl8723bs-prevent-buffer-overflow-in-update_sta_support_rate.patch queue-5.4/tcp_cubic-fix-spurious-hystart_delay-exit-upon-drop-in-min-rtt.patch queue-5.4/tcp-don-t-ignore-ecn-cwr-on-pure-ack.patch queue-5.4/dm-writecache-add-cond_resched-to-loop-in-persistent_memory_claim.patch queue-5.4/alsa-usb-audio-fix-oob-access-of-mixer-element-list.patch queue-5.4/revert-tty-hvc-fix-data-abort-due-to-race-in-hvc_open.patch queue-5.4/erofs-fix-partially-uninitialized-misuse-in-z_erofs_onlinepage_fixup.patch queue-5.4/usb-dwc2-postponed-gadget-registration-to-the-udc-class-driver.patch queue-5.4/alsa-hda-realtek-add-mute-led-and-micmute-led-support-for-hp-systems.patch queue-5.4/btrfs-fix-bytes_may_use-underflow-when-running-balance-and-scrub-in-parallel.patch queue-5.4/usb-host-ehci-exynos-fix-error-check-in-exynos_ehci_probe.patch queue-5.4/ip_tunnel-fix-use-after-free-in-ip_tunnel_lookup.patch queue-5.4/arm64-perf-report-the-pc-value-in-regs_abi_32-mode.patch queue-5.4/drm-radeon-fix-fb_div-check-in-ni_init_smc_spll_table.patch queue-5.4/rocker-fix-incorrect-error-handling-in-dma_rings_init.patch queue-5.4/mm-memcontrol.c-add-missed-css_put.patch queue-5.4/tcp-grow-window-for-ooo-packets-only-for-sack-flows.patch queue-5.4/kvm-nvmx-plumb-l2-gpa-through-to-pml-emulation.patch queue-5.4/drm-amd-fix-potential-memleak-in-err-branch.patch queue-5.4/usb-cdns3-trace-using-correct-dir-value.patch queue-5.4/alsa-hda-add-nvidia-codec-ids-9a-9d-through-a0-to-patch-table.patch queue-5.4/sch_cake-don-t-call-diffserv-parsing-code-when-it-is-not-needed.patch queue-5.4/loop-replace-kill_bdev-with-invalidate_bdev.patch queue-5.4/btrfs-fix-failure-of-rwf_nowait-write-into-prealloc-extent-beyond-eof.patch queue-5.4/binder-fix-null-deref-of-proc-context.patch queue-5.4/acpi-sysfs-fix-pm_profile_attr-type.patch queue-5.4/ocfs2-fix-panic-on-nfs-server-over-ocfs2.patch queue-5.4/pnfs-flexfiles-fix-list-corruption-if-the-mirror-count-changes.patch queue-5.4/x86-cpu-use-pinning-mask-for-cr4-bits-needing-to-be-0.patch queue-5.4/ib-hfi1-fix-module-use-count-flaw-due-to-leftover-module-put-calls.patch queue-5.4/alsa-hda-realtek-add-quirk-for-msi-ge63-laptop.patch queue-5.4/net-phy-check-harder-for-errors-in-get_phy_id.patch queue-5.4/sch_cake-fix-a-few-style-nits.patch queue-5.4/mm-slab-use-memzero_explicit-in-kzfree.patch queue-5.4/acpi-configfs-disallow-loading-acpi-tables-when-locked-down.patch queue-5.4/sunrpc-properly-set-the-subbuf-parameter-of-xdr_buf_subsegment.patch queue-5.4/arm64-dts-imx8mn-ddr4-evk-correct-ldo1-ldo2-voltage-range.patch queue-5.4/cdc-acm-add-disable_echo-quirk-for-microchip-smsc-chip.patch queue-5.4/kvm-x86-fix-msr-range-of-apic-registers-in-x2apic-mode.patch queue-5.4/sunrpc-fixed-rollback-in-rpc_gssd_dummy_populate.patch queue-5.4/drm-rcar-du-fix-build-error.patch queue-5.4/ip6_gre-fix-use-after-free-in-ip6gre_tunnel_lookup.patch queue-5.4/openvswitch-take-into-account-de-fragmentation-gso_size-in-execute_check_pkt_len.patch queue-5.4/block-bio-integrity-don-t-free-buf-if-bio_integrity_add_page-failed.patch queue-5.4/usb-ehci-reopen-solution-for-synopsys-hc-bug.patch queue-5.4/tracing-fix-event-trigger-to-accept-redundant-spaces.patch queue-5.4/usb-host-xhci-mtk-avoid-runtime-suspend-when-removing-hcd.patch queue-5.4/ibmveth-fix-max-mtu-limit.patch queue-5.4/usb-typec-tcpci_rt1711h-avoid-screaming-irq-causing-boot-hangs.patch queue-5.4/ring-buffer-zero-out-time-extend-if-it-is-nested-and-not-absolute.patch queue-5.4/ocfs2-avoid-inode-removal-while-nfsd-is-accessing-it.patch queue-5.4/ocfs2-load-global_inode_alloc.patch queue-5.4/btrfs-check-if-a-log-root-exists-before-locking-the-log_mutex-on-unlink.patch queue-5.4/btrfs-fix-data-block-group-relocation-failure-due-to-concurrent-scrub.patch queue-5.4/alsa-usb-audio-add-implicit-feedback-quirk-for-ssl2.patch queue-5.4/dm-writecache-correct-uncommitted_block-when-discarding-uncommitted-entry.patch queue-5.4/usb-cdns3-ep0-fix-the-test-mode-set-incorrectly.patch queue-5.4/net-increment-xmit_recursion-level-in-dev_direct_xmit.patch queue-5.4/xprtrdma-fix-handling-of-rdma_error-replies.patch queue-5.4/usb-add-usb_quirk_delay_init-for-logitech-c922.patch queue-5.4/scsi-zfcp-fix-panic-on-erp-timeout-for-previously-dismissed-erp-action.patch queue-5.4/net-bridge-enfore-alignment-for-ethernet-address.patch queue-5.4/enetc-fix-tx-rings-bitmap-iteration-range-irq-handling.patch queue-5.4/usb-renesas_usbhs-getting-residue-from-callback_resu.patch queue-5.4/sch_cake-don-t-try-to-reallocate-or-unshare-skb-unconditionally.patch queue-5.4/kvm-vmx-stop-context-switching-msr_ia32_umwait_control.patch queue-5.4/xhci-poll-for-u0-after-disabling-usb2-lpm.patch