From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752146AbbIAULQ (ORCPT ); Tue, 1 Sep 2015 16:11:16 -0400 Received: from mail-wi0-f177.google.com ([209.85.212.177]:38152 "EHLO mail-wi0-f177.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751860AbbIAULP (ORCPT ); Tue, 1 Sep 2015 16:11:15 -0400 From: Dmitry Vyukov To: gregkh@linuxfoundation.org, peter@hurleysoftware.com, jslaby@suse.com, linux-kernel@vger.kernel.org Cc: jslaby@suse.cz, andreyknvl@google.com, kcc@google.com, glider@google.com, Dmitry Vyukov Subject: [PATCH] tty: fix data race in flush_to_ldisc Date: Tue, 1 Sep 2015 22:11:10 +0200 Message-Id: <1441138270-17505-1-git-send-email-dvyukov@google.com> X-Mailer: git-send-email 2.5.0.457.gab17608 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The data race is found with KernelThreadSanitizer (on rev 21bdb584af8c): ThreadSanitizer: data-race in release_tty Write of size 8 by thread T325 (K2579): release_tty+0xf3/0x1c0 drivers/tty/tty_io.c:1688 tty_release+0x698/0x7c0 drivers/tty/tty_io.c:1920 __fput+0x15f/0x310 fs/file_table.c:207 ____fput+0x1d/0x30 fs/file_table.c:243 task_work_run+0x115/0x130 kernel/task_work.c:123 do_notify_resume+0x73/0x80 tracehook_notify_resume include/linux/tracehook.h:190 do_notify_resume+0x73/0x80 arch/x86/kernel/signal.c:757 int_signal+0x12/0x17 arch/x86/entry/entry_64.S:326 Previous read of size 8 by thread T19 (K16): flush_to_ldisc+0x29/0x300 drivers/tty/tty_buffer.c:472 process_one_work+0x47e/0x930 kernel/workqueue.c:2036 worker_thread+0xb0/0x900 kernel/workqueue.c:2170 kthread+0x150/0x170 kernel/kthread.c:207 flush_to_ldisc reads port->itty and checks that it is not NULL, concurrently release_tty sets port->itty to NULL. It is possible that flush_to_ldisc loads port->itty once, ensures that it is not NULL, but then reloads it again and uses. The second load can already return NULL, which will cause a crash. Set port->itty to NULL after shutting down flush_to_ldisc work. Signed-off-by: Dmitry Vyukov --- drivers/tty/tty_io.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c index 57fc6ee..0df24c1 100644 --- a/drivers/tty/tty_io.c +++ b/drivers/tty/tty_io.c @@ -1684,9 +1684,9 @@ static void release_tty(struct tty_struct *tty, int idx) tty_free_termios(tty); tty_driver_remove_tty(tty->driver, tty); tty->port->itty = NULL; + cancel_work_sync(&tty->port->buf.work); if (tty->link) tty->link->port->itty = NULL; - cancel_work_sync(&tty->port->buf.work); tty_kref_put(tty->link); tty_kref_put(tty); -- 2.5.0.457.gab17608