mirror-linux/drivers/tty
Krzysztof Kozlowski 32f37e5758 serial: Fix not set tty->port race condition
Revert commit bfc467db60 ("serial: remove redundant
tty_port_link_device()") because the tty_port_link_device() is not
redundant: the tty->port has to be confured before we call
uart_configure_port(), otherwise user-space can open console without TTY
linked to the driver.

This tty_port_link_device() was added explicitly to avoid this exact
issue in commit fb2b90014d ("tty: link tty and port before configuring
it as console"), so offending commit basically reverted the fix saying
it is redundant without addressing the actual race condition presented
there.

Reproducible always as tty->port warning on Qualcomm SoC with most of
devices disabled, so with very fast boot, and one serial device being
the console:

  printk: legacy console [ttyMSM0] enabled
  printk: legacy console [ttyMSM0] enabled
  printk: legacy bootconsole [qcom_geni0] disabled
  printk: legacy bootconsole [qcom_geni0] disabled
  ------------[ cut here ]------------
  tty_init_dev: ttyMSM driver does not set tty->port. This would crash the kernel. Fix the driver!
  WARNING: drivers/tty/tty_io.c:1414 at tty_init_dev.part.0+0x228/0x25c, CPU#2: systemd/1
  Modules linked in: socinfo tcsrcc_eliza gcc_eliza sm3_ce fuse ipv6
  CPU: 2 UID: 0 PID: 1 Comm: systemd Tainted: G S                  6.19.0-rc4-next-20260108-00024-g2202f4d30aa8 #73 PREEMPT
  Tainted: [S]=CPU_OUT_OF_SPEC
  Hardware name: Qualcomm Technologies, Inc. Eliza (DT)
  ...
  tty_init_dev.part.0 (drivers/tty/tty_io.c:1414 (discriminator 11)) (P)
  tty_open (arch/arm64/include/asm/atomic_ll_sc.h:95 (discriminator 3) drivers/tty/tty_io.c:2073 (discriminator 3) drivers/tty/tty_io.c:2120 (discriminator 3))
  chrdev_open (fs/char_dev.c:411)
  do_dentry_open (fs/open.c:962)
  vfs_open (fs/open.c:1094)
  do_open (fs/namei.c:4634)
  path_openat (fs/namei.c:4793)
  do_filp_open (fs/namei.c:4820)
  do_sys_openat2 (fs/open.c:1391 (discriminator 3))
  ...
  Starting Network Name Resolution...

Apparently the flow with this small Yocto-based ramdisk user-space is:

driver (qcom_geni_serial.c):                  user-space:
============================                  ===========
qcom_geni_serial_probe()
 uart_add_one_port()
  serial_core_register_port()
   serial_core_add_one_port()
    uart_configure_port()
     register_console()
    |
    |                                         open console
    |                                          ...
    |                                          tty_init_dev()
    |                                           driver->ports[idx] is NULL
    |
    tty_port_register_device_attr_serdev()
     tty_port_link_device() <- set driver->ports[idx]

Fixes: bfc467db60 ("serial: remove redundant tty_port_link_device()")
Cc: stable@vger.kernel.org
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
Link: https://patch.msgid.link/20260123072139.53293-2-krzysztof.kozlowski@oss.qualcomm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-23 17:23:09 +01:00
..
hvc Merge 6.17-rc6 into tty-next 2025-09-15 08:27:31 +02:00
ipwireless treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
serdev serdev: Drop dev_pm_domain_detach() call 2025-09-06 15:48:38 +02:00
serial serial: Fix not set tty->port race condition 2026-01-23 17:23:09 +01:00
vt tty: vt: do not open code DIV_ROUND_UP() 2025-11-21 18:31:27 +01:00
Kconfig TTY/Serial driver updates for 6.15-rc1 2025-04-02 18:17:33 -07:00
Makefile
amiserial.c tty: amiserial: Fix namespace collision and startup() section placement with -ffunction-sections 2025-11-21 10:04:09 +01:00
ehv_bytechan.c
goldfish.c Get rid of 'remove_new' relic from platform driver struct 2024-12-01 15:12:43 -08:00
mips_ejtag_fdc.c treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
moxa.c tty: moxa: use guard()s 2025-11-21 18:30:40 +01:00
mxser.c mxser: use guard()s 2025-08-17 12:46:26 +02:00
n_gsm.c tty: document @dlci parameter in gsm_modem_send_initial_msc 2025-10-28 15:25:00 +01:00
n_hdlc.c tty: n_hdlc: use guard()s 2025-11-21 18:30:40 +01:00
n_null.c
n_tty.c tty: n_tty: use guard()s 2025-11-21 18:30:40 +01:00
nozomi.c
pty.c TTY/Serial changes for 6.19-rc1 2025-12-06 18:38:19 -08:00
rpmsg_tty.c
synclink_gt.c tty: synclink_gt: Fix namespace collision and startup() section placement with -ffunction-sections 2025-11-21 10:04:10 +01:00
sysrq.c tty: sysrq: delete unnecessary check 2025-08-13 17:42:26 +02:00
tty.h
tty_audit.c tty: audit: do not use N_TTY_BUF_SIZE 2025-03-20 08:00:50 -07:00
tty_baudrate.c
tty_buffer.c tty: replace use of system_unbound_wq with system_dfl_wq 2025-11-26 13:11:09 +01:00
tty_io.c tty: use lock guard()s in tty_io 2025-04-25 13:46:31 +02:00
tty_ioctl.c tty: simplify throttling using guard()s 2025-04-25 13:46:30 +02:00
tty_jobctrl.c
tty_ldisc.c
tty_ldsem.c tty/ldsem: Remove unused ldsem_down_write_trylock 2025-02-04 14:38:42 +01:00
tty_mutex.c
tty_port.c tty: tty_port: use guard()s 2025-08-17 12:46:26 +02:00
ttynull.c
vcc.c treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00