[PATCH v2] pps: reject N_PPS on pseudo-terminals

[PATCH v2] pps: reject N_PPS on pseudo-terminals

[Hungyu Lin]

Attaching N_PPS to a PTY registers a PPS source even though PTYs do not
report DCD changes. An unprivileged user can exhaust the PPS source IDs
this way, causing registration of a real PPS source to fail with
-EBUSY.

Reject N_PPS on PTYs before allocating a source.

Fixes: a0880df0ccde ("pps: serial clients support")
Suggested-by: Rodolfo Giometti <giometti@enneenne.com>
Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
---
Changes in v2:
- Reject PTYs before registering a PPS source, as suggested by Rodolfo.
- Drop the stable Cc.

v1: https://lore.kernel.org/r/20261107211753.75932-1-dennylin0707@gmail.com

 drivers/pps/clients/pps-ldisc.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/pps/clients/pps-ldisc.c b/drivers/pps/clients/pps-ldisc.c
index fa5660f3c4b7..83f4caced0c9 100644
--- a/drivers/pps/clients/pps-ldisc.c
+++ b/drivers/pps/clients/pps-ldisc.c
@@ -46,6 +46,9 @@ static int pps_tty_open(struct tty_struct *tty)
 	struct pps_device *pps;
 	int ret;
 
+	if (drv->type == TTY_DRIVER_TYPE_PTY)
+		return -EINVAL;
+
 	info.owner = THIS_MODULE;
 	info.dev = NULL;
 	snprintf(info.name, PPS_MAX_NAME_LEN, "%s%d", drv->driver_name, index);
-- 
2.50.1 (Apple Git-155)

Re: [PATCH v2] pps: reject N_PPS on pseudo-terminals

[Rodolfo Giometti]

On 11/11/2026 14:27, Hungyu Lin wrote:
> Attaching N_PPS to a PTY registers a PPS source even though PTYs do not
> report DCD changes. An unprivileged user can exhaust the PPS source IDs
> this way, causing registration of a real PPS source to fail with
> -EBUSY.
> 
> Reject N_PPS on PTYs before allocating a source.
> 
> Fixes: a0880df0ccde ("pps: serial clients support")
> Suggested-by: Rodolfo Giometti <giometti@enneenne.com>
> Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
> ---
> Changes in v2:
> - Reject PTYs before registering a PPS source, as suggested by Rodolfo.
> - Drop the stable Cc.
> 
> v1: https://lore.kernel.org/r/20261107211753.75932-1-dennylin0707@gmail.com
> 
>  drivers/pps/clients/pps-ldisc.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/pps/clients/pps-ldisc.c b/drivers/pps/clients/pps-ldisc.c
> index fa5660f3c4b7..83f4caced0c9 100644
> --- a/drivers/pps/clients/pps-ldisc.c
> +++ b/drivers/pps/clients/pps-ldisc.c
> @@ -46,6 +46,9 @@ static int pps_tty_open(struct tty_struct *tty)
>  	struct pps_device *pps;
>  	int ret;
>  
> +	if (drv->type == TTY_DRIVER_TYPE_PTY)
> +		return -EINVAL;
> +
>  	info.owner = THIS_MODULE;
>  	info.dev = NULL;
>  	snprintf(info.name, PPS_MAX_NAME_LEN, "%s%d", drv->driver_name, index);

Acked-by: Rodolfo Giometti <giometti@enneenne.com>

-- 
GNU/Linux Solutions                  e-mail: giometti@enneenne.com
Linux Device Driver                          giometti@linux.it
Embedded Systems                     phone:  +39 349 2432127
UNIX programming