Re: [PATCH] speakup: don't use the ldisc data after a hangup

[Samuel Thibault <samuel.thibault@ens-lyon.org>]

Greg KH, le mar. 27 oct. 2026 17:31:21 +0100, a ecrit:
> From: Josef Bacik <josef@toxicpanda.com>
> 
> ttyio_in() takes the struct spk_ldisc_data from tty->disc_data and waits
> for its completion. The structure belongs to the line discipline:
> spk_ttyio_ldisc_close() frees it, and leaves the pointer in place.
> 
> speakup holds the tty until the synthesizer is released, but the line
> discipline can be closed before that. A hangup of the port does it:
> __tty_hangup() calls tty_ldisc_hangup(), and as no file is open for the
> tty, this one calls tty_ldisc_kill(). The port is hung up when a USB
> serial adapter is pulled out, and when a serial port for which CLOCAL was
> switched off loses the carrier.
> 
> After that every call of ttyio_in() takes the lock of a completion in
> freed memory and may write to it. The LiteTalk and Speakout drivers call
> it through spk_synth_get_index() whenever "read all" is used. If the
> hangup comes while ttyio_in() sleeps, the completion is freed under it.
> 
> Take a reference to the line discipline for the time the data is used,
> and report that there is no input if there is none any more.
> tty_ldisc_ref() does not sleep, so it can be used by the callers in
> atomic context, too. Also clear the pointer when the data is freed.
> 
> Fixes: 6b9ad1c742bf ("staging: speakup: add send_xchar, tiocmset and input functionality for tty")
> Cc: stable <stable@kernel.org>
> Cc: William Hubbs <w.d.hubbs@gmail.com>
> Cc: Chris Brannon <chris@the-brannons.com>
> Cc: Kirk Reiser <kirk@reisers.ca>
> Cc: Samuel Thibault <samuel.thibault@ens-lyon.org>

Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>

Thanks!

Samuel

> Signed-off-by: Josef Bacik <josef@toxicpanda.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> ---
>  drivers/accessibility/speakup/spk_ttyio.c | 18 ++++++++++++++----
>  1 file changed, 14 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/accessibility/speakup/spk_ttyio.c b/drivers/accessibility/speakup/spk_ttyio.c
> index 6bff78e3d872..44139d870ac4 100644
> --- a/drivers/accessibility/speakup/spk_ttyio.c
> +++ b/drivers/accessibility/speakup/spk_ttyio.c
> @@ -69,6 +69,7 @@ static int spk_ttyio_ldisc_open(struct tty_struct *tty)
>  static void spk_ttyio_ldisc_close(struct tty_struct *tty)
>  {
>  	kfree(tty->disc_data);
> +	tty->disc_data = NULL;
>  }
>  
>  static size_t spk_ttyio_receive_buf2(struct tty_struct *tty, const u8 *cp,
> @@ -291,17 +292,24 @@ static int spk_ttyio_wait_for_xmitr(struct spk_synth *in_synth)
>  static unsigned char ttyio_in(struct spk_synth *in_synth, int timeout)
>  {
>  	struct tty_struct *tty = in_synth->dev;
> -	struct spk_ldisc_data *ldisc_data = tty->disc_data;
> -	char rv;
> +	struct spk_ldisc_data *ldisc_data;
> +	struct tty_ldisc *ld;
> +	char rv = 0xff;
> +
> +	/* A hangup of the port closes the line discipline, which frees its data. */
> +	ld = tty_ldisc_ref(tty);
> +	if (!ld)
> +		return 0xff;
> +	ldisc_data = tty->disc_data;
>  
>  	if (!timeout) {
>  		if (!try_wait_for_completion(&ldisc_data->completion))
> -			return 0xff;
> +			goto out;
>  	} else if (wait_for_completion_timeout(&ldisc_data->completion,
>  					usecs_to_jiffies(timeout)) == 0) {
>  		pr_warn("spk_ttyio: timeout (%d)  while waiting for input\n",
>  			timeout);
> -		return 0xff;
> +		goto out;
>  	}
>  
>  	rv = ldisc_data->buf;
> @@ -312,6 +320,8 @@ static unsigned char ttyio_in(struct spk_synth *in_synth, int timeout)
>  	ldisc_data->buf_free = true;
>  	/* Let TTY push more characters */
>  	tty_flip_buffer_push(tty->port);
> +out:
> +	tty_ldisc_deref(ld);
>  
>  	return rv;
>  }
> -- 
> 2.56.0
> 

-- 
Samuel
c> [ ] morning [ ] afternoon [ ] evening [ ] night , everyone (choose as applicable)