TTY: make tty_add_file non-failing
If tty_add_file fails at the point it is now, we have to revert all
the changes we did to the tty. It means either decrease all refcounts
if this was a tty reopen or delete the tty if it was newly allocated.
There was a try to fix this in v3.0-rc2 using tty_release in 0259894c7
(TTY: fix fail path in tty_open). But instead it introduced a NULL
dereference. It's because tty_release dereferences
filp->private_data, but that one is set even in our tty_add_file. And
when tty_add_file fails, it's still NULL/garbage. Hence tty_release
cannot be called there.
To circumvent the original leak (and the current NULL deref) we split
tty_add_file into two functions, making the latter non-failing. In
that case we may do the former early in open, where handling failures
is easy. The latter stays as it is now. So there is no change in
functionality.
The original bug (leak) was introduced by f573bd176 (tty: Remove
__GFP_NOFAIL from tty_add_file()). Thanks Dan for reporting this.
Later, we may split tty_release into more functions and call only some
of them in this fail path instead. (If at all possible.)
Introduced-in: v2.6.37-rc2
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: stable <stable@vger.kernel.org>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: Pekka Enberg <penberg@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
index 98b6e3b..7613f95 100644
--- a/drivers/tty/pty.c
+++ b/drivers/tty/pty.c
@@ -657,12 +657,18 @@
nonseekable_open(inode, filp);
+ retval = tty_alloc_file(filp);
+ if (retval)
+ return retval;
+
/* find a device that is not in use. */
tty_lock();
index = devpts_new_index(inode);
tty_unlock();
- if (index < 0)
- return index;
+ if (index < 0) {
+ retval = index;
+ goto err_file;
+ }
mutex_lock(&tty_mutex);
tty_lock();
@@ -676,9 +682,7 @@
set_bit(TTY_PTY_LOCK, &tty->flags); /* LOCK THE SLAVE */
- retval = tty_add_file(tty, filp);
- if (retval)
- goto out;
+ tty_add_file(tty, filp);
retval = devpts_pty_new(inode, tty->link);
if (retval)
@@ -697,6 +701,8 @@
out:
devpts_kill_index(inode, index);
tty_unlock();
+err_file:
+ tty_free_file(filp);
return retval;
}