[PATCH] tty: nozomi: lock tty_icount reads against the IRQ update path

[PATCH] tty: nozomi: lock tty_icount reads against the IRQ update path

[Muhammad Bilal]

receive_flow_control() updates port->tty_icount.{cts,dsr,rng,dcd}
while interrupt_handler() holds dc->spin_mutex, but ntty_tiocgicount()
and the TIOCMIWAIT snapshot/compare loop in ntty_ioctl()/
ntty_cflags_changed() read the same multi-field struct with no lock
at all. A concurrent update can be observed mid-copy, and KCSAN flags
the unlocked access.

Add ntty_get_icount() to snapshot port->tty_icount under
dc->spin_mutex and use it at all three read sites, matching the lock
already used on the update side.

Fixes: 20fd1e3bea55 ("nozomi driver")
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
---
 drivers/tty/nozomi.c | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/drivers/tty/nozomi.c b/drivers/tty/nozomi.c
index ed99dbc9f990..4b2e224c0aa2 100644
--- a/drivers/tty/nozomi.c
+++ b/drivers/tty/nozomi.c
@@ -1671,10 +1671,23 @@ static int ntty_tiocmset(struct tty_struct *tty,
 	return 0;
 }
 
+static struct async_icount ntty_get_icount(struct port *port)
+{
+	struct nozomi *dc = port->dc;
+	struct async_icount cnow;
+	unsigned long flags;
+
+	spin_lock_irqsave(&dc->spin_mutex, flags);
+	cnow = port->tty_icount;
+	spin_unlock_irqrestore(&dc->spin_mutex, flags);
+
+	return cnow;
+}
+
 static int ntty_cflags_changed(struct port *port, unsigned long flags,
 		struct async_icount *cprev)
 {
-	const struct async_icount cnow = port->tty_icount;
+	const struct async_icount cnow = ntty_get_icount(port);
 	int ret;
 
 	ret = ((flags & TIOCM_RNG) && (cnow.rng != cprev->rng))
@@ -1691,7 +1704,7 @@ static int ntty_tiocgicount(struct tty_struct *tty,
 				struct serial_icounter_struct *icount)
 {
 	struct port *port = tty->driver_data;
-	const struct async_icount cnow = port->tty_icount;
+	const struct async_icount cnow = ntty_get_icount(port);
 
 	icount->cts = cnow.cts;
 	icount->dsr = cnow.dsr;
@@ -1715,7 +1728,7 @@ static int ntty_ioctl(struct tty_struct *tty,
 
 	switch (cmd) {
 	case TIOCMIWAIT: {
-		struct async_icount cprev = port->tty_icount;
+		struct async_icount cprev = ntty_get_icount(port);
 
 		rval = wait_event_interruptible(port->tty_wait,
 				ntty_cflags_changed(port, arg, &cprev));
-- 
2.55.0