[PATCH] speakup: don't use the ldisc data after a hangup

[PATCH] speakup: don't use the ldisc data after a hangup

[Greg Kroah-Hartman]

From: Josef Bacik <josef@toxicpanda.com>

ttyio_in() takes the struct spk_ldisc_data from tty->disc_data and waits
for its completion. The structure belongs to the line discipline:
spk_ttyio_ldisc_close() frees it, and leaves the pointer in place.

speakup holds the tty until the synthesizer is released, but the line
discipline can be closed before that. A hangup of the port does it:
__tty_hangup() calls tty_ldisc_hangup(), and as no file is open for the
tty, this one calls tty_ldisc_kill(). The port is hung up when a USB
serial adapter is pulled out, and when a serial port for which CLOCAL was
switched off loses the carrier.

After that every call of ttyio_in() takes the lock of a completion in
freed memory and may write to it. The LiteTalk and Speakout drivers call
it through spk_synth_get_index() whenever "read all" is used. If the
hangup comes while ttyio_in() sleeps, the completion is freed under it.

Take a reference to the line discipline for the time the data is used,
and report that there is no input if there is none any more.
tty_ldisc_ref() does not sleep, so it can be used by the callers in
atomic context, too. Also clear the pointer when the data is freed.

Fixes: 6b9ad1c742bf ("staging: speakup: add send_xchar, tiocmset and input functionality for tty")
Cc: stable <stable@kernel.org>
Cc: William Hubbs <w.d.hubbs@gmail.com>
Cc: Chris Brannon <chris@the-brannons.com>
Cc: Kirk Reiser <kirk@reisers.ca>
Cc: Samuel Thibault <samuel.thibault@ens-lyon.org>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/accessibility/speakup/spk_ttyio.c | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/drivers/accessibility/speakup/spk_ttyio.c b/drivers/accessibility/speakup/spk_ttyio.c
index 6bff78e3d872..44139d870ac4 100644
--- a/drivers/accessibility/speakup/spk_ttyio.c
+++ b/drivers/accessibility/speakup/spk_ttyio.c
@@ -69,6 +69,7 @@ static int spk_ttyio_ldisc_open(struct tty_struct *tty)
 static void spk_ttyio_ldisc_close(struct tty_struct *tty)
 {
 	kfree(tty->disc_data);
+	tty->disc_data = NULL;
 }
 
 static size_t spk_ttyio_receive_buf2(struct tty_struct *tty, const u8 *cp,
@@ -291,17 +292,24 @@ static int spk_ttyio_wait_for_xmitr(struct spk_synth *in_synth)
 static unsigned char ttyio_in(struct spk_synth *in_synth, int timeout)
 {
 	struct tty_struct *tty = in_synth->dev;
-	struct spk_ldisc_data *ldisc_data = tty->disc_data;
-	char rv;
+	struct spk_ldisc_data *ldisc_data;
+	struct tty_ldisc *ld;
+	char rv = 0xff;
+
+	/* A hangup of the port closes the line discipline, which frees its data. */
+	ld = tty_ldisc_ref(tty);
+	if (!ld)
+		return 0xff;
+	ldisc_data = tty->disc_data;
 
 	if (!timeout) {
 		if (!try_wait_for_completion(&ldisc_data->completion))
-			return 0xff;
+			goto out;
 	} else if (wait_for_completion_timeout(&ldisc_data->completion,
 					usecs_to_jiffies(timeout)) == 0) {
 		pr_warn("spk_ttyio: timeout (%d)  while waiting for input\n",
 			timeout);
-		return 0xff;
+		goto out;
 	}
 
 	rv = ldisc_data->buf;
@@ -312,6 +320,8 @@ static unsigned char ttyio_in(struct spk_synth *in_synth, int timeout)
 	ldisc_data->buf_free = true;
 	/* Let TTY push more characters */
 	tty_flip_buffer_push(tty->port);
+out:
+	tty_ldisc_deref(ld);
 
 	return rv;
 }
-- 
2.56.0

Re: [PATCH] speakup: don't use the ldisc data after a hangup

[Samuel Thibault]

Greg KH, le mar. 27 oct. 2026 17:31:21 +0100, a ecrit:
> From: Josef Bacik <josef@toxicpanda.com>
> 
> ttyio_in() takes the struct spk_ldisc_data from tty->disc_data and waits
> for its completion. The structure belongs to the line discipline:
> spk_ttyio_ldisc_close() frees it, and leaves the pointer in place.
> 
> speakup holds the tty until the synthesizer is released, but the line
> discipline can be closed before that. A hangup of the port does it:
> __tty_hangup() calls tty_ldisc_hangup(), and as no file is open for the
> tty, this one calls tty_ldisc_kill(). The port is hung up when a USB
> serial adapter is pulled out, and when a serial port for which CLOCAL was
> switched off loses the carrier.
> 
> After that every call of ttyio_in() takes the lock of a completion in
> freed memory and may write to it. The LiteTalk and Speakout drivers call
> it through spk_synth_get_index() whenever "read all" is used. If the
> hangup comes while ttyio_in() sleeps, the completion is freed under it.
> 
> Take a reference to the line discipline for the time the data is used,
> and report that there is no input if there is none any more.
> tty_ldisc_ref() does not sleep, so it can be used by the callers in
> atomic context, too. Also clear the pointer when the data is freed.
> 
> Fixes: 6b9ad1c742bf ("staging: speakup: add send_xchar, tiocmset and input functionality for tty")
> Cc: stable <stable@kernel.org>
> Cc: William Hubbs <w.d.hubbs@gmail.com>
> Cc: Chris Brannon <chris@the-brannons.com>
> Cc: Kirk Reiser <kirk@reisers.ca>
> Cc: Samuel Thibault <samuel.thibault@ens-lyon.org>

Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>

Thanks!

Samuel

> Signed-off-by: Josef Bacik <josef@toxicpanda.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> ---
>  drivers/accessibility/speakup/spk_ttyio.c | 18 ++++++++++++++----
>  1 file changed, 14 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/accessibility/speakup/spk_ttyio.c b/drivers/accessibility/speakup/spk_ttyio.c
> index 6bff78e3d872..44139d870ac4 100644
> --- a/drivers/accessibility/speakup/spk_ttyio.c
> +++ b/drivers/accessibility/speakup/spk_ttyio.c
> @@ -69,6 +69,7 @@ static int spk_ttyio_ldisc_open(struct tty_struct *tty)
>  static void spk_ttyio_ldisc_close(struct tty_struct *tty)
>  {
>  	kfree(tty->disc_data);
> +	tty->disc_data = NULL;
>  }
>  
>  static size_t spk_ttyio_receive_buf2(struct tty_struct *tty, const u8 *cp,
> @@ -291,17 +292,24 @@ static int spk_ttyio_wait_for_xmitr(struct spk_synth *in_synth)
>  static unsigned char ttyio_in(struct spk_synth *in_synth, int timeout)
>  {
>  	struct tty_struct *tty = in_synth->dev;
> -	struct spk_ldisc_data *ldisc_data = tty->disc_data;
> -	char rv;
> +	struct spk_ldisc_data *ldisc_data;
> +	struct tty_ldisc *ld;
> +	char rv = 0xff;
> +
> +	/* A hangup of the port closes the line discipline, which frees its data. */
> +	ld = tty_ldisc_ref(tty);
> +	if (!ld)
> +		return 0xff;
> +	ldisc_data = tty->disc_data;
>  
>  	if (!timeout) {
>  		if (!try_wait_for_completion(&ldisc_data->completion))
> -			return 0xff;
> +			goto out;
>  	} else if (wait_for_completion_timeout(&ldisc_data->completion,
>  					usecs_to_jiffies(timeout)) == 0) {
>  		pr_warn("spk_ttyio: timeout (%d)  while waiting for input\n",
>  			timeout);
> -		return 0xff;
> +		goto out;
>  	}
>  
>  	rv = ldisc_data->buf;
> @@ -312,6 +320,8 @@ static unsigned char ttyio_in(struct spk_synth *in_synth, int timeout)
>  	ldisc_data->buf_free = true;
>  	/* Let TTY push more characters */
>  	tty_flip_buffer_push(tty->port);
> +out:
> +	tty_ldisc_deref(ld);
>  
>  	return rv;
>  }
> -- 
> 2.56.0
> 

-- 
Samuel
c> [ ] morning [ ] afternoon [ ] evening [ ] night , everyone (choose as applicable)