From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: AH8x227aGJqNMmzCfXm3kJOZ/M39SBhqo9m1Pwt8NmO+Zdr9+hCC/An886tqkFmuPEe/JlrLdqqq ARC-Seal: i=1; a=rsa-sha256; t=1516693600; cv=none; d=google.com; s=arc-20160816; b=nWxiowVzqJ8vQWplTxdy9IRvF4nP9r8T+w1+50kn9+v+ZjMFBbFRD4o+IjEgjqvDCJ HJRFNZOuJitUHJsdGIUuX9YkwQIrapTc9UfMzn+8dPtcfPCj1NQsJBJSqYcBPNLs1xJ8 nKFEu6EPe4RenU1KuBL4WX40D1d25ZpacWaST6c31awBjTaTsFyqYe48dgBwweMv9m0B DxA+KTKeGtRoQfovL5xb3E9ptbnuTCdLK2pA+tds/KU2IZrzqZ3cBx8w7GVmd/xhfnqT 5F9VcHjSh+h1E/hY0FQdgxqGz85SQwUX9d5hzkjJaJCbXcN3yX7Ue2nqP3gCmFULYCJR qsvA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=message-id:date:subject:cc:to:from:arc-authentication-results; bh=j9zeWSeCq6AJ2BlkiO/tmA8bGHAhZsP5wMtPOR83qac=; b=SGqpo4jaYhTq1Qeai4QFzEgJ09TaCH+jTmmfln3GD5ooAu2tAuDtjl/kD/G+fwQv+/ Wq1i65EAoikkE51z2krjWvko8r+4gRyy9dOSKTe/kkRwlIcVdmy053621sbjLqESpMb3 WnbGMYrS7husthfs+XooWp3+c98CcXKgQs5hVu04aMx9qfP7xhtGAS2LyoZp08cJZRgX 2q1+PZuS4VOk3/Hoj3/ScxWB6LAmjqK/1wvS9Xn0hXYiVAk9YBeiqTAy7YeGUFM97euL 25rc+oXNZxWAHerjVNssfd5RA42I/j0SP1dA4TNyXRCot77IDM5si0YP+uoszpWv9hCg uzpw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of gkohli@qualcomm.com designates 199.106.114.254 as permitted sender) smtp.mailfrom=gkohli@qualcomm.com Authentication-Results: mx.google.com; spf=pass (google.com: domain of gkohli@qualcomm.com designates 199.106.114.254 as permitted sender) smtp.mailfrom=gkohli@qualcomm.com X-IronPort-AV: E=Sophos;i="5.46,400,1511856000"; d="scan'208";a="321472591" X-IronPort-AV: E=McAfee;i="5900,7806,8781"; a="58224803" X-MGA-submission: =?us-ascii?q?MDGKF0rjSTsF6lEEHjbKMI45q9RfUcsha9ZYLA?= =?us-ascii?q?8CvOSG9Wx1iOuLKQVmT5mzcF/rjPLSyKogv7DNGHEDwqeu8HSKTJmc+b?= =?us-ascii?q?UXH5xYM6JDYA+eQj3EintWI05xBkTq+l1lCYIZY1hDFJmtc0wLh9bD7y?= =?us-ascii?q?V2?= From: Gaurav Kohli To: gnomes@lxorguk.ukuu.org.uk, gregkh@linuxfoundation.org Cc: linux-kernel@vger.kernel.org, linux-arm-msm@vger.kernel.org, Gaurav Kohli Subject: [PATCH V2] tty: fix data race between tty_init_dev and flush of buf Date: Tue, 23 Jan 2018 13:16:34 +0530 Message-Id: <1516693594-28288-1-git-send-email-gkohli@codeaurora.org> X-Mailer: git-send-email 1.9.1 X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: =?utf-8?q?1590368508637285963?= X-GMAIL-MSGID: =?utf-8?q?1590368508637285963?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: There can be a race, if receive_buf call comes before tty initialization completes in n_tty_open and tty->disc_data may be NULL. CPU0 CPU1 ---- ---- 000|n_tty_receive_buf_common() n_tty_open() -001|n_tty_receive_buf2() tty_ldisc_open.isra.3() -002|tty_ldisc_receive_buf(inline) tty_ldisc_setup() Using ldisc semaphore lock in tty_init_dev till disc_data initializes completely. Signed-off-by: Gaurav Kohli Reviewed-by: Alan Cox Cc: stable --- Changes since V1: - Fix compilation, In case TTY is disabled in build. diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c index dc60aee..4b506f2 100644 --- a/drivers/tty/tty_io.c +++ b/drivers/tty/tty_io.c @@ -1323,6 +1323,9 @@ struct tty_struct *tty_init_dev(struct tty_driver *driver, int idx) "%s: %s driver does not set tty->port. This will crash the kernel later. Fix the driver!\n", __func__, tty->driver->name); + retval = tty_ldisc_lock(tty, 5 * HZ); + if (retval) + goto err_release_lock; tty->port->itty = tty; /* @@ -1333,6 +1336,7 @@ struct tty_struct *tty_init_dev(struct tty_driver *driver, int idx) retval = tty_ldisc_setup(tty, tty->link); if (retval) goto err_release_tty; + tty_ldisc_unlock(tty); /* Return the tty locked so that it cannot vanish under the caller */ return tty; @@ -1345,9 +1349,11 @@ struct tty_struct *tty_init_dev(struct tty_driver *driver, int idx) /* call the tty release_tty routine to clean out this slot */ err_release_tty: - tty_unlock(tty); + tty_ldisc_unlock(tty); tty_info_ratelimited(tty, "ldisc open failed (%d), clearing slot %d\n", retval, idx); +err_release_lock: + tty_unlock(tty); release_tty(tty, idx); return ERR_PTR(retval); } diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c index 24ec5c7..4e7946c 100644 --- a/drivers/tty/tty_ldisc.c +++ b/drivers/tty/tty_ldisc.c @@ -337,7 +337,7 @@ static inline void __tty_ldisc_unlock(struct tty_struct *tty) ldsem_up_write(&tty->ldisc_sem); } -static int tty_ldisc_lock(struct tty_struct *tty, unsigned long timeout) +int tty_ldisc_lock(struct tty_struct *tty, unsigned long timeout) { int ret; @@ -348,7 +348,7 @@ static int tty_ldisc_lock(struct tty_struct *tty, unsigned long timeout) return 0; } -static void tty_ldisc_unlock(struct tty_struct *tty) +void tty_ldisc_unlock(struct tty_struct *tty) { clear_bit(TTY_LDISC_HALTED, &tty->flags); __tty_ldisc_unlock(tty); diff --git a/include/linux/tty.h b/include/linux/tty.h index 7ac8ba2..0a6c71e 100644 --- a/include/linux/tty.h +++ b/include/linux/tty.h @@ -405,6 +405,8 @@ static inline bool tty_throttled(struct tty_struct *tty) extern struct tty_struct *tty_kopen(dev_t device); extern void tty_kclose(struct tty_struct *tty); extern int tty_dev_name_to_number(const char *name, dev_t *number); +extern int tty_ldisc_lock(struct tty_struct *tty, unsigned long timeout); +extern void tty_ldisc_unlock(struct tty_struct *tty); #else static inline void tty_kref_put(struct tty_struct *tty) { } -- Qualcomm India Private Limited, on behalf of Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum, a Linux Foundation Collaborative Project.