linux/drivers/tty
Krzysztof Kozlowski 32f37e5758 serial: Fix not set tty->port race condition
Revert commit bfc467db60 ("serial: remove redundant
tty_port_link_device()") because the tty_port_link_device() is not
redundant: the tty->port has to be confured before we call
uart_configure_port(), otherwise user-space can open console without TTY
linked to the driver.

This tty_port_link_device() was added explicitly to avoid this exact
issue in commit fb2b90014d ("tty: link tty and port before configuring
it as console"), so offending commit basically reverted the fix saying
it is redundant without addressing the actual race condition presented
there.

Reproducible always as tty->port warning on Qualcomm SoC with most of
devices disabled, so with very fast boot, and one serial device being
the console:

  printk: legacy console [ttyMSM0] enabled
  printk: legacy console [ttyMSM0] enabled
  printk: legacy bootconsole [qcom_geni0] disabled
  printk: legacy bootconsole [qcom_geni0] disabled
  ------------[ cut here ]------------
  tty_init_dev: ttyMSM driver does not set tty->port. This would crash the kernel. Fix the driver!
  WARNING: drivers/tty/tty_io.c:1414 at tty_init_dev.part.0+0x228/0x25c, CPU#2: systemd/1
  Modules linked in: socinfo tcsrcc_eliza gcc_eliza sm3_ce fuse ipv6
  CPU: 2 UID: 0 PID: 1 Comm: systemd Tainted: G S                  6.19.0-rc4-next-20260108-00024-g2202f4d30aa8 #73 PREEMPT
  Tainted: [S]=CPU_OUT_OF_SPEC
  Hardware name: Qualcomm Technologies, Inc. Eliza (DT)
  ...
  tty_init_dev.part.0 (drivers/tty/tty_io.c:1414 (discriminator 11)) (P)
  tty_open (arch/arm64/include/asm/atomic_ll_sc.h:95 (discriminator 3) drivers/tty/tty_io.c:2073 (discriminator 3) drivers/tty/tty_io.c:2120 (discriminator 3))
  chrdev_open (fs/char_dev.c:411)
  do_dentry_open (fs/open.c:962)
  vfs_open (fs/open.c:1094)
  do_open (fs/namei.c:4634)
  path_openat (fs/namei.c:4793)
  do_filp_open (fs/namei.c:4820)
  do_sys_openat2 (fs/open.c:1391 (discriminator 3))
  ...
  Starting Network Name Resolution...

Apparently the flow with this small Yocto-based ramdisk user-space is:

driver (qcom_geni_serial.c):                  user-space:
============================                  ===========
qcom_geni_serial_probe()
 uart_add_one_port()
  serial_core_register_port()
   serial_core_add_one_port()
    uart_configure_port()
     register_console()
    |
    |                                         open console
    |                                          ...
    |                                          tty_init_dev()
    |                                           driver->ports[idx] is NULL
    |
    tty_port_register_device_attr_serdev()
     tty_port_link_device() <- set driver->ports[idx]

Fixes: bfc467db60 ("serial: remove redundant tty_port_link_device()")
Cc: stable@vger.kernel.org
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
Link: https://patch.msgid.link/20260123072139.53293-2-krzysztof.kozlowski@oss.qualcomm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-23 17:23:09 +01:00
..
hvc Merge 6.17-rc6 into tty-next 2025-09-15 08:27:31 +02:00
ipwireless treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
serdev serdev: Drop dev_pm_domain_detach() call 2025-09-06 15:48:38 +02:00
serial serial: Fix not set tty->port race condition 2026-01-23 17:23:09 +01:00
vt tty: vt: do not open code DIV_ROUND_UP() 2025-11-21 18:31:27 +01:00
amiserial.c tty: amiserial: Fix namespace collision and startup() section placement with -ffunction-sections 2025-11-21 10:04:09 +01:00
ehv_bytechan.c tty: ehv_bytechan: convert to u8 and size_t 2023-12-08 12:02:37 +01:00
goldfish.c Get rid of 'remove_new' relic from platform driver struct 2024-12-01 15:12:43 -08:00
Kconfig TTY/Serial driver updates for 6.15-rc1 2025-04-02 18:17:33 -07:00
Makefile
mips_ejtag_fdc.c treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
moxa.c tty: moxa: use guard()s 2025-11-21 18:30:40 +01:00
mxser.c mxser: use guard()s 2025-08-17 12:46:26 +02:00
n_gsm.c tty: document @dlci parameter in gsm_modem_send_initial_msc 2025-10-28 15:25:00 +01:00
n_hdlc.c tty: n_hdlc: use guard()s 2025-11-21 18:30:40 +01:00
n_null.c tty: ldops: unify to u8 2023-08-11 21:12:47 +02:00
n_tty.c tty: n_tty: use guard()s 2025-11-21 18:30:40 +01:00
nozomi.c tty: nozomi: convert to u8 and size_t 2023-12-08 12:02:38 +01:00
pty.c TTY/Serial changes for 6.19-rc1 2025-12-06 18:38:19 -08:00
rpmsg_tty.c tty: make tty_operations::write()'s count size_t 2023-08-11 21:12:46 +02:00
synclink_gt.c tty: synclink_gt: Fix namespace collision and startup() section placement with -ffunction-sections 2025-11-21 10:04:10 +01:00
sysrq.c tty: sysrq: delete unnecessary check 2025-08-13 17:42:26 +02:00
tty.h tty: convert THROTTLE constants into enum 2023-10-03 14:31:16 +02:00
tty_audit.c tty: audit: do not use N_TTY_BUF_SIZE 2025-03-20 08:00:50 -07:00
tty_baudrate.c
tty_buffer.c tty: replace use of system_unbound_wq with system_dfl_wq 2025-11-26 13:11:09 +01:00
tty_io.c tty: use lock guard()s in tty_io 2025-04-25 13:46:31 +02:00
tty_ioctl.c tty: simplify throttling using guard()s 2025-04-25 13:46:30 +02:00
tty_jobctrl.c tty: tty_jobctrl: fix pid memleak in disassociate_ctty() 2023-09-18 11:14:43 +02:00
tty_ldisc.c tty: add the option to have a tty reject a new ldisc 2024-05-04 18:45:11 +02:00
tty_ldsem.c tty/ldsem: Remove unused ldsem_down_write_trylock 2025-02-04 14:38:42 +01:00
tty_mutex.c
tty_port.c tty: tty_port: use guard()s 2025-08-17 12:46:26 +02:00
ttynull.c tty: add missing MODULE_DESCRIPTION() macros 2024-06-24 16:10:11 +02:00
vcc.c treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00