Rob Herring d0f4bce2bc tty: serial_core: fix NULL struct tty pointer access in uart_write_wakeup ... Since commit 761ed4a945 ("tty: serial_core: convert uart_close to use tty_port_close"), the serial console is broken on various systems and typing "reboot" splats the following on the serial console: INIT: Sending p[ 427.863916] BUG: unable to handle kernel NULL pointer dereference at 00000000000001e0 [ 427.885156] IP: [] tty_wakeup+0xc/0x70 [ 427.898337] PGD 0 [ 427.902051] [ 427.907498] Oops: 0000 [#1] PREEMPT SMP [ 427.917635] Modules linked in: nfsv3 nfs_acl nfs fscache lockd sunrpc grace edd af_packet cpufreq_conservative cpufreq_userspace cpufreq_powersave fuse loop md_mod dm_mod joydev hid_generic usbhid ipmi_ssif ohci_pci ohci_hcd ehci_pci ehci_hcd e1000e ptp firewire_ohci edac_core pps_core tpm_infineon sp5100_tco firewire_core acpi_cpufreq serio_raw pcspkr fjes usbcore shpchp edac_mce_amd tpm_tis ipmi_si tpm_tis_core i2c_piix4 k10temp sg ipmi_msghandler tpm sr_mod button cdrom kvm_amd kvm irqbypass crc_itu_t ast ttm drm_kms_helper drm fb_sys_fops sysimgblt sysfillrect syscopyarea i2c_algo_bit scsi_dh_rdac scsi_dh_alua scsi_dh_emc scsi_dh_hp_sw ata_generic pata_atiixp [ 428.054179] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.9.0-rc1-1.g73e3f23-default #1 [ 428.072868] Hardware name: System manufacturer System Product Name/KGP(M)E-D16, BIOS 0902 12/03/2010 [ 428.094755] task: ffffffffa2c0d500 task.stack: ffffffffa2c00000 [ 428.109717] RIP: 0010:[] [] tty_wakeup+0xc/0x70 [ 428.128407] RSP: 0018:ffff9a1a5fc03df8 EFLAGS: 00010086 [ 428.142184] RAX: ffff9a1857258000 RBX: ffffffffa3050ea0 RCX: 0000000000000000 [ 428.159649] RDX: 000000000000001b RSI: 0000000000000000 RDI: 0000000000000000 [ 428.177109] RBP: ffff9a1a5fc03e08 R08: 0000000000000000 R09: 0000000000000000 [ 428.194547] R10: 0000000000021c77 R11: 0000000000000000 R12: ffff9a1857258000 [ 428.212002] R13: 0000000000000000 R14: 0000000000000020 R15: 0000000000000020 [ 428.229481] FS: 0000000000000000(0000) GS:ffff9a1a5fc00000(0000) knlGS:0000000000000000 [ 428.248938] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 428.263726] CR2: 00000000000001e0 CR3: 0000000390c06000 CR4: 00000000000006f0 [ 428.281331] Stack: [ 428.288696] ffffffffa3050ea0 ffff9a1857258000 ffff9a1a5fc03e18 ffffffffa24e0ab1 [ 428.307064] ffff9a1a5fc03e40 ffffffffa24e8865 ffffffffa3050ea0 00000000000000c2 [ 428.325456] 0000000000000046 ffff9a1a5fc03e78 ffffffffa24e8a5f ffffffffa3050ea0 [ 428.343905] Call Trace: [ 428.352319] [ 428.356216] [] uart_write_wakeup+0x21/0x30 The problem is for console ports, the serial port is not shutdown and interrupts may fire after the struct tty is gone. Simply calling the tty_port helper tty_port_tty_wakeup instead of tty_wakeup directly will ensure there is a valid struct tty. Fixes: 761ed4a945 ("tty: serial_core: convert uart_close to use tty_port_close") Reported-by: Borislav Petkov <bp@alien8.de> Reported-by: Mike Galbraith <mgalbraith@suse.de> Cc: Jiri Slaby <jslaby@suse.cz> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: linux-serial@vger.kernel.org Signed-off-by: Rob Herring <robh@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2016-10-28 08:13:07 -04:00
..
hvc	tty/hvc: Use opal irqchip interface if available	2016-07-27 12:38:20 +10:00
ipwireless	tty: ipwireless, cleanup TIOCGSERIAL	2016-06-25 08:56:30 -07:00
serial	tty: serial_core: fix NULL struct tty pointer access in uart_write_wakeup	2016-10-28 08:13:07 -04:00
vt	vt: clear selection before resizing	2016-10-27 17:19:35 +02:00
amiserial.c	tty: Replace ASYNC_INITIALIZED bit and update atomically	2016-04-30 09:26:55 -07:00
bfin_jtag_comm.c
cyclades.c	tty: stop defining STD_COM_FLAGS in drivers	2016-06-25 08:56:30 -07:00
ehv_bytechan.c	drivers/tty: make ehv_bytechan.c explicitly non-modular	2016-02-06 23:26:43 -08:00
goldfish.c	tty: goldfish: support platform_device with id -1	2016-03-07 16:11:14 -08:00
isicom.c	tty: Replace ASYNC_INITIALIZED bit and update atomically	2016-04-30 09:26:55 -07:00
Kconfig	devpts: Make each mount of devpts an independent filesystem.	2016-06-05 10:36:01 -07:00
Makefile
metag_da.c	timers, drivers/tty/metag_da: Initialize the poll timer as pinned	2016-07-07 10:25:14 +02:00
mips_ejtag_fdc.c	timers, drivers/tty/mips_ejtag: Initialize the poll timer as pinned	2016-07-07 10:34:59 +02:00
moxa.c	tty: Replace ASYNC_INITIALIZED bit and update atomically	2016-04-30 09:26:55 -07:00
moxa.h
mxser.c	tty: cyclades+mxser, do not initialize to zero	2016-06-25 08:56:30 -07:00
mxser.h
n_gsm.c	TTY and Serial driver update for 4.7-rc1	2016-05-20 20:57:27 -07:00
n_hdlc.c	Fix OpenSSH pty regression on close	2016-05-01 13:22:54 -07:00
n_r3964.c
n_tracerouter.c
n_tracesink.c
n_tracesink.h
n_tty.c	Fix OpenSSH pty regression on close	2016-05-01 13:22:54 -07:00
nozomi.c	tty: Replace TTY_THROTTLED bit tests with tty_throttled()	2016-04-30 09:26:55 -07:00
pty.c	pty: make ptmx file ops read-only after init	2016-09-15 12:47:03 +02:00
rocket.c	TTY: add __init attribute	2016-04-30 09:26:55 -07:00
rocket.h
rocket_int.h	tty: rocket: Remove private close_wait	2016-01-28 14:13:44 -08:00
synclink.c	TTY and Serial driver update for 4.7-rc1	2016-05-20 20:57:27 -07:00
synclink_gt.c	TTY and Serial driver update for 4.7-rc1	2016-05-20 20:57:27 -07:00
synclinkmp.c	TTY and Serial driver update for 4.7-rc1	2016-05-20 20:57:27 -07:00
sysrq.c	Revert "drivers/tty: Explicitly pass current to show_stack"	2016-09-28 08:12:27 +02:00
tty_audit.c	tty: audit: remove unused variable	2016-03-07 16:11:14 -08:00
tty_buffer.c	Fix OpenSSH pty regression on close	2016-05-01 13:22:54 -07:00
tty_io.c	Merge 4.6-rc7 into tty-next	2016-05-09 09:39:13 +02:00
tty_ioctl.c	tty: Replace TTY_THROTTLED bit tests with tty_throttled()	2016-04-30 09:26:55 -07:00
tty_ldisc.c	tty: Eliminate global symbol tty_ldisc_N_TTY	2016-01-27 15:13:28 -08:00
tty_ldsem.c	tty: Deinline __ldsem_down_write_nested, save 128 bytes	2015-12-13 19:59:48 -08:00
tty_mutex.c	Merge 4.5-rc4 into tty-next	2016-02-14 14:36:04 -08:00
tty_port.c	tty: Replace ASYNC_INITIALIZED bit and update atomically	2016-04-30 09:26:55 -07:00