Re: [PATCH] tty: fix data race in flush_to_ldisc

From: Dmitry Vyukov <dvyukov@google.com>
To: Peter Hurley <peter@hurleysoftware.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	jslaby@suse.com, LKML <linux-kernel@vger.kernel.org>,
	Jiri Slaby <jslaby@suse.cz>,
	Andrey Konovalov <andreyknvl@google.com>,
	Kostya Serebryany <kcc@google.com>,
	Alexander Potapenko <glider@google.com>
Subject: Re: [PATCH] tty: fix data race in flush_to_ldisc
Date: Wed, 2 Sep 2015 16:41:25 +0200	[thread overview]
Message-ID: <CACT4Y+aQw4j_69w4sgSuzG95aEekrAh-QVX2MPknrv16n7n2cQ@mail.gmail.com> (raw)
In-Reply-To: <55E70518.6010005@hurleysoftware.com>

On Wed, Sep 2, 2015 at 4:18 PM, Peter Hurley <peter@hurleysoftware.com> wrote:
> On 09/01/2015 04:11 PM, Dmitry Vyukov wrote:
>> The data race is found with KernelThreadSanitizer (on rev 21bdb584af8c):
>>
>> ThreadSanitizer: data-race in release_tty
>> Write of size 8 by thread T325 (K2579):
>>   release_tty+0xf3/0x1c0 drivers/tty/tty_io.c:1688
>>   tty_release+0x698/0x7c0 drivers/tty/tty_io.c:1920
>>   __fput+0x15f/0x310 fs/file_table.c:207
>>   ____fput+0x1d/0x30 fs/file_table.c:243
>>   task_work_run+0x115/0x130 kernel/task_work.c:123
>>   do_notify_resume+0x73/0x80
>>     tracehook_notify_resume include/linux/tracehook.h:190
>>   do_notify_resume+0x73/0x80 arch/x86/kernel/signal.c:757
>>   int_signal+0x12/0x17 arch/x86/entry/entry_64.S:326
>> Previous read of size 8 by thread T19 (K16):
>>   flush_to_ldisc+0x29/0x300 drivers/tty/tty_buffer.c:472
>>   process_one_work+0x47e/0x930 kernel/workqueue.c:2036
>>   worker_thread+0xb0/0x900 kernel/workqueue.c:2170
>>   kthread+0x150/0x170 kernel/kthread.c:207
>>
>> flush_to_ldisc reads port->itty and checks that it is not NULL,
>> concurrently release_tty sets port->itty to NULL. It is possible
>> that flush_to_ldisc loads port->itty once, ensures that it is
>> not NULL, but then reloads it again and uses. The second load
>> can already return NULL, which will cause a crash.
>>
>> Set port->itty to NULL after shutting down flush_to_ldisc work.
>>
>> Signed-off-by: Dmitry Vyukov <dvyukov@google.com>
>> ---
>>  drivers/tty/tty_io.c | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
>> index 57fc6ee..0df24c1 100644
>> --- a/drivers/tty/tty_io.c
>> +++ b/drivers/tty/tty_io.c
>> @@ -1684,9 +1684,9 @@ static void release_tty(struct tty_struct *tty, int idx)
>>       tty_free_termios(tty);
>>       tty_driver_remove_tty(tty->driver, tty);
>>       tty->port->itty = NULL;
>> +     cancel_work_sync(&tty->port->buf.work);
>>       if (tty->link)
>>               tty->link->port->itty = NULL;
>> -     cancel_work_sync(&tty->port->buf.work);
>
> This patch doesn't do anything.

It sets tty->link->port->itty to NULL _after_ waiting for
flush_to_ldisc work to finish. At least this is the intention.
Can you explain why it does not do anything?

Thank you.