linux/drivers/tty
Peter Hurley 62a0d8d7c2 tty: Fix lockless tty buffer race
Commit 6a20dbd6ca,
"tty: Fix race condition between __tty_buffer_request_room and flush_to_ldisc"
correctly identifies an unsafe race condition between
__tty_buffer_request_room() and flush_to_ldisc(), where the consumer
flush_to_ldisc() prematurely advances the head before consuming the
last of the data committed. For example:

           CPU 0                     |            CPU 1
__tty_buffer_request_room            | flush_to_ldisc
  ...                                |   ...
                                     |   count = head->commit - head->read
  n = tty_buffer_alloc()             |
  b->commit = b->used                |
  b->next = n                        |
                                     |   if (!count)                /* T */
                                     |     if (head->next == NULL)  /* F */
                                     |     buf->head = head->next

In this case, buf->head has been advanced but head->commit may have
been updated with a new value.

Instead of reintroducing an unnecessary lock, fix the race locklessly.
Read the commit-next pair in the reverse order of writing, which guarantees
the commit value read is the latest value written if the head is
advancing.

Reported-by: Manfred Schlaegl <manfred.schlaegl@gmx.at>
Cc: <stable@vger.kernel.org> # 3.12.x+
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 18:14:28 -04:00
..
hvc drivers/tty/hvc: don't free hvc_console_setup after init 2014-05-03 18:14:28 -04:00
ipwireless tty: Fix low_latency BUG 2014-02-28 16:31:00 -08:00
serial tty: serial: 8250_core.c Bug fix for Exar chips. 2014-05-03 18:13:05 -04:00
vt vt: detect and ignore OSC codes. 2014-02-28 16:25:47 -08:00
Kconfig drivers/tty: ehv_bytechan fails to build as a module 2014-01-09 17:52:12 -06:00
Makefile
amiserial.c tty/amiserial: avoid interruptible_sleep_on 2014-01-07 17:05:21 -08:00
bfin_jtag_comm.c
cyclades.c tty: an overflow of multiplication in drivers/tty/cyclades.c 2013-12-20 12:21:57 -08:00
ehv_bytechan.c
goldfish.c tty: delete non-required instances of include <linux/init.h> 2014-01-07 17:05:21 -08:00
isicom.c
metag_da.c
moxa.c
moxa.h
mxser.c
mxser.h
n_gsm.c tty: n_gsm: Fix for modems with brk in modem status control 2014-02-07 08:40:54 -08:00
n_hdlc.c
n_r3964.c
n_tracerouter.c
n_tracesink.c
n_tracesink.h
n_tty.c n_tty: Fix n_tty_write crash when echoing in raw mode 2014-05-03 18:13:05 -04:00
nozomi.c
pty.c
rocket.c
rocket.h
rocket_int.h
synclink.c synclink: fix info leak in ioctl 2014-03-17 16:13:23 -07:00
synclink_gt.c tty: synclink: avoid sleep_on race 2014-01-07 17:05:21 -08:00
synclinkmp.c synclink: fix info leak in ioctl 2014-03-17 16:13:23 -07:00
sysrq.c
tty_audit.c audit: anchor all pid references in the initial pid namespace 2014-03-20 10:11:55 -04:00
tty_buffer.c tty: Fix lockless tty buffer race 2014-05-03 18:14:28 -04:00
tty_io.c tty: fix memleak in alloc_pid 2014-04-16 14:31:13 -07:00
tty_ioctl.c
tty_ldisc.c tty: delete non-required instances of include <linux/init.h> 2014-01-07 17:05:21 -08:00
tty_ldsem.c lockdep: Make held_lock->check and "int check" argument bool 2014-02-09 21:18:54 +01:00
tty_mutex.c
tty_port.c tty: delete non-required instances of include <linux/init.h> 2014-01-07 17:05:21 -08:00