Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753158AbeAQNYa (ORCPT + 1 other); Wed, 17 Jan 2018 08:24:30 -0500 Received: from wolverine02.qualcomm.com ([199.106.114.251]:52702 "EHLO wolverine02.qualcomm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752499AbeAQNY3 (ORCPT ); Wed, 17 Jan 2018 08:24:29 -0500 X-IronPort-AV: E=Sophos;i="5.46,372,1511856000"; d="scan'208";a="416204473" X-MGA-submission: =?us-ascii?q?MDHMC6oX5bbBE8EQvkt9j229Qn5kQ6hK2bKxOz?= =?us-ascii?q?6o32DZ8O9Tt+o78Hal+c8GuihN+XX2iKyrAh3gh1JrmGYI/paJqWy1tl?= =?us-ascii?q?DEM1OM8T8/d4K2pjDl7rxWtOF7gFv8DBUbxw6DknKWdm4q4YNtP4QNvN?= =?us-ascii?q?kw?= From: Gaurav Kohli To: gnomes@lxorguk.ukuu.org.uk Cc: jslaby@suse.com, gregkh@linuxfoundation.org, mikey@neuling.org, linux-kernel@vger.kernel.org, linux-arm-msm@vger.kernel.org, Gaurav Kohli Subject: [PATCH V1] tty: fix data race between tty_init_dev and flush of buf Date: Wed, 17 Jan 2018 18:54:19 +0530 Message-Id: <1516195459-1080-1-git-send-email-gkohli@codeaurora.org> X-Mailer: git-send-email 1.9.1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Return-Path: There can be a race, if receive_buf call comes before tty initialization completes in n_tty_open and tty->disc_data may be NULL. CPU0 CPU1 ---- ---- 000|n_tty_receive_buf_common() n_tty_open() -001|n_tty_receive_buf2() tty_ldisc_open.isra.3() -002|tty_ldisc_receive_buf(inline) tty_ldisc_setup() Using ldisc semaphore lock in tty_init_dev till disc_data initializes completely. Signed-off-by: Gaurav Kohli --- Changes since V0: - Add semaphore lock as suggested. - Tested it for 4-5 days for stability cycle and no issue observed. diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c index dc60aee..4b506f2 100644 --- a/drivers/tty/tty_io.c +++ b/drivers/tty/tty_io.c @@ -1323,6 +1323,9 @@ struct tty_struct *tty_init_dev(struct tty_driver *driver, int idx) "%s: %s driver does not set tty->port. This will crash the kernel later. Fix the driver!\n", __func__, tty->driver->name); + retval = tty_ldisc_lock(tty, 5 * HZ); + if (retval) + goto err_release_lock; tty->port->itty = tty; /* @@ -1333,6 +1336,7 @@ struct tty_struct *tty_init_dev(struct tty_driver *driver, int idx) retval = tty_ldisc_setup(tty, tty->link); if (retval) goto err_release_tty; + tty_ldisc_unlock(tty); /* Return the tty locked so that it cannot vanish under the caller */ return tty; @@ -1345,9 +1349,11 @@ struct tty_struct *tty_init_dev(struct tty_driver *driver, int idx) /* call the tty release_tty routine to clean out this slot */ err_release_tty: - tty_unlock(tty); + tty_ldisc_unlock(tty); tty_info_ratelimited(tty, "ldisc open failed (%d), clearing slot %d\n", retval, idx); +err_release_lock: + tty_unlock(tty); release_tty(tty, idx); return ERR_PTR(retval); } diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c index 24ec5c7..4e7946c 100644 --- a/drivers/tty/tty_ldisc.c +++ b/drivers/tty/tty_ldisc.c @@ -337,7 +337,7 @@ static inline void __tty_ldisc_unlock(struct tty_struct *tty) ldsem_up_write(&tty->ldisc_sem); } -static int tty_ldisc_lock(struct tty_struct *tty, unsigned long timeout) +int tty_ldisc_lock(struct tty_struct *tty, unsigned long timeout) { int ret; @@ -348,7 +348,7 @@ static int tty_ldisc_lock(struct tty_struct *tty, unsigned long timeout) return 0; } -static void tty_ldisc_unlock(struct tty_struct *tty) +void tty_ldisc_unlock(struct tty_struct *tty) { clear_bit(TTY_LDISC_HALTED, &tty->flags); __tty_ldisc_unlock(tty); diff --git a/include/linux/tty.h b/include/linux/tty.h index 7ac8ba2..e939ac7 100644 --- a/include/linux/tty.h +++ b/include/linux/tty.h @@ -405,6 +405,8 @@ static inline bool tty_throttled(struct tty_struct *tty) extern struct tty_struct *tty_kopen(dev_t device); extern void tty_kclose(struct tty_struct *tty); extern int tty_dev_name_to_number(const char *name, dev_t *number); +extern int tty_ldisc_lock(struct tty_struct *tty, unsigned long timeout); +extern void tty_ldisc_unlock(struct tty_struct *tty); #else static inline void tty_kref_put(struct tty_struct *tty) { } @@ -431,6 +433,10 @@ static inline void tty_kclose(struct tty_struct *tty) { } static inline int tty_dev_name_to_number(const char *name, dev_t *number) { return -ENOTSUPP; } +static inline int tty_ldisc_lock(struct tty_struct *tty, unsigned long timeout); +{ return 0; } +static inline void tty_ldisc_unlock(struct tty_struct *tty); +{ } #endif extern struct ktermios tty_std_termios; -- Qualcomm India Private Limited, on behalf of Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum, a Linux Foundation Collaborative Project.