• Dmitry Vyukov's avatar
    tty: fix data race on tty_buffer.commit · facd885c
    Dmitry Vyukov authored
    Race on buffer data happens when newly committed data is
    picked up by an old flush work in the following scenario:
    __tty_buffer_request_room does a plain write of tail->commit,
    no barriers were executed before that.
    At this point flush_to_ldisc reads this new value of commit,
    and reads buffer data, no barriers in between.
    The committed buffer data is not necessary visible to flush_to_ldisc.
    
    Similar bug happens when tty_schedule_flip commits data.
    
    Update commit with smp_store_release and read commit with
    smp_load_acquire, as it is commit that signals data readiness.
    This is orthogonal to the existing synchronization on tty_buffer.next,
    which is required to not dismiss a buffer with unconsumed data.
    
    The data race was found with KernelThreadSanitizer (KTSAN).
    Signed-off-by: default avatarDmitry Vyukov <dvyukov@google.com>
    Reviewed-by: default avatarPeter Hurley <peter@hurleysoftware.com>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    facd885c
tty_buffer.c 15.3 KB