[PATCH v2] tty: fix data race in flush_to_ldisc

From	Dmitry Vyukov <dvyukov@google.com>
Newsgroups	linux.kernel
Subject	[PATCH v2] tty: fix data race in flush_to_ldisc
Date	2015-09-17 12:40 +0200
Message-ID	<q9ELD-TQ-11@gated-at.bofh.it> (permalink)
Organization	linux.* mail to news gateway

Show all headers | View raw

flush_to_ldisc reads port->itty and checks that it is not NULL,
concurrently release_tty sets port->itty to NULL. It is possible
that flush_to_ldisc loads port->itty once, ensures that it is
not NULL, but then reloads it again and uses. The second load
can already return NULL, which will cause a crash.

Use READ_ONCE to read port->itty.

The data race was found with KernelThreadSanitizer (KTSAN).

Signed-off-by: Dmitry Vyukov <dvyukov@google.com>

---

Changed since first version:
 - remove WRITE_ONCE when updating port->itty
---
 drivers/tty/tty_buffer.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c
index 5a3fa89..23de97d 100644
--- a/drivers/tty/tty_buffer.c
+++ b/drivers/tty/tty_buffer.c
@@ -467,7 +467,7 @@ static void flush_to_ldisc(struct work_struct *work)
 	struct tty_struct *tty;
 	struct tty_ldisc *disc;
 
-	tty = port->itty;
+	tty = READ_ONCE(port->itty);
 	if (tty == NULL)
 		return;
 
-- 
2.6.0.rc0.131.gf624c3d

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

[PATCH v2] tty: fix data race in flush_to_ldisc Dmitry Vyukov <dvyukov@google.com> - 2015-09-17 12:40 +0200
  Re: [PATCH v2] tty: fix data race in flush_to_ldisc Greg KH <gregkh@linuxfoundation.org> - 2015-09-17 15:00 +0200
    Re: [PATCH v2] tty: fix data race in flush_to_ldisc Peter Hurley <peter@hurleysoftware.com> - 2015-09-17 15:20 +0200
      Re: [PATCH v2] tty: fix data race in flush_to_ldisc Dmitry Vyukov <dvyukov@google.com> - 2015-09-17 15:30 +0200
        Re: [PATCH v2] tty: fix data race in flush_to_ldisc Greg KH <gregkh@linuxfoundation.org> - 2015-09-17 16:00 +0200
      Re: [PATCH v2] tty: fix data race in flush_to_ldisc Greg KH <gregkh@linuxfoundation.org> - 2015-09-17 16:00 +0200

csiph-web