[PATCH] tty: fix lock order inversion in tty_buffer_flush()

[PATCH] tty: fix lock order inversion in tty_buffer_flush()

[Ömer Mete Kaya]

tty_buffer_flush() calls ld->ops->flush_buffer() while holding
buf->lock. For the N_TTY line discipline, flush_buffer() is
n_tty_flush_buffer(), which acquires termios_rwsem.

However, the documented stable lock order (see tty.h) is:
  termios_rwsem -> buf->lock

Calling flush_buffer() under buf->lock inverts this order and creates
a circular locking dependency detected by lockdep:

  &buf->lock -> console_lock -> &port->mutex -> &tty->termios_rwsem
                                                -> &buf->lock

Fix this by moving the flush_buffer() call outside buf->lock.
The buffer data has already been discarded at this point, so the
ordering change is safe.

Reported-by: syzbot+d84934b4184d7f9a1aed@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d84934b4184d7f9a1aed
Signed-off-by: Ömer Mete Kaya <omermetekaya0@gmail.com>
---
 drivers/tty/tty_buffer.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c
index 96be90db5..bb7b7fbcb 100644
--- a/drivers/tty/tty_buffer.c
+++ b/drivers/tty/tty_buffer.c
@@ -244,11 +244,15 @@ void tty_buffer_flush(struct tty_struct *tty, struct tty_ldisc *ld)
 	buf->head->read = buf->head->commit;
 	buf->head->lookahead = buf->head->read;
 
-	if (ld && ld->ops->flush_buffer)
-		ld->ops->flush_buffer(tty);
-
 	atomic_dec(&buf->priority);
 	mutex_unlock(&buf->lock);
+	/*
+	 * Call flush_buffer() outside buf->lock: n_tty_flush_buffer()
+	 * acquires termios_rwsem, but the required lock order is
+	 * termios_rwsem -> buf->lock, not the other way around.
+	 */
+	if (ld && ld->ops->flush_buffer)
+		ld->ops->flush_buffer(tty);
 }
 
 /**
-- 
2.55.0

Re: [PATCH] tty: fix lock order inversion in tty_buffer_flush()

[Greg KH]

On Tue, Aug 04, 2026 at 05:02:51PM +0300, Ömer Mete Kaya wrote:
> tty_buffer_flush() calls ld->ops->flush_buffer() while holding
> buf->lock. For the N_TTY line discipline, flush_buffer() is
> n_tty_flush_buffer(), which acquires termios_rwsem.
> 
> However, the documented stable lock order (see tty.h) is:
>   termios_rwsem -> buf->lock
> 
> Calling flush_buffer() under buf->lock inverts this order and creates
> a circular locking dependency detected by lockdep:
> 
>   &buf->lock -> console_lock -> &port->mutex -> &tty->termios_rwsem
>                                                 -> &buf->lock
> 
> Fix this by moving the flush_buffer() call outside buf->lock.
> The buffer data has already been discarded at this point, so the
> ordering change is safe.
> 
> Reported-by: syzbot+d84934b4184d7f9a1aed@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=d84934b4184d7f9a1aed

Did syzbot actually test this?  How did you test this?

Did you forget an Assisted-by: tag?

> Signed-off-by: Ömer Mete Kaya <omermetekaya0@gmail.com>
> ---
>  drivers/tty/tty_buffer.c | 10 +++++++---
>  1 file changed, 7 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c
> index 96be90db5..bb7b7fbcb 100644
> --- a/drivers/tty/tty_buffer.c
> +++ b/drivers/tty/tty_buffer.c
> @@ -244,11 +244,15 @@ void tty_buffer_flush(struct tty_struct *tty, struct tty_ldisc *ld)
>  	buf->head->read = buf->head->commit;
>  	buf->head->lookahead = buf->head->read;
>  
> -	if (ld && ld->ops->flush_buffer)
> -		ld->ops->flush_buffer(tty);
> -
>  	atomic_dec(&buf->priority);
>  	mutex_unlock(&buf->lock);
> +	/*
> +	 * Call flush_buffer() outside buf->lock: n_tty_flush_buffer()
> +	 * acquires termios_rwsem, but the required lock order is
> +	 * termios_rwsem -> buf->lock, not the other way around.
> +	 */
> +	if (ld && ld->ops->flush_buffer)
> +		ld->ops->flush_buffer(tty);

This feels wrong, what is going to break with this change?  What commit
does this change fix?

thanks,

greg k-h