linux/drivers/tty
Peter Hurley 62a0d8d7c2 tty: Fix lockless tty buffer race
Commit 6a20dbd6ca,
"tty: Fix race condition between __tty_buffer_request_room and flush_to_ldisc"
correctly identifies an unsafe race condition between
__tty_buffer_request_room() and flush_to_ldisc(), where the consumer
flush_to_ldisc() prematurely advances the head before consuming the
last of the data committed. For example:

           CPU 0                     |            CPU 1
__tty_buffer_request_room            | flush_to_ldisc
  ...                                |   ...
                                     |   count = head->commit - head->read
  n = tty_buffer_alloc()             |
  b->commit = b->used                |
  b->next = n                        |
                                     |   if (!count)                /* T */
                                     |     if (head->next == NULL)  /* F */
                                     |     buf->head = head->next

In this case, buf->head has been advanced but head->commit may have
been updated with a new value.

Instead of reintroducing an unnecessary lock, fix the race locklessly.
Read the commit-next pair in the reverse order of writing, which guarantees
the commit value read is the latest value written if the head is
advancing.

Reported-by: Manfred Schlaegl <manfred.schlaegl@gmx.at>
Cc: <stable@vger.kernel.org> # 3.12.x+
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-03 18:14:28 -04:00
..
hvc drivers/tty/hvc: don't free hvc_console_setup after init 2014-05-03 18:14:28 -04:00
ipwireless tty: Fix low_latency BUG 2014-02-28 16:31:00 -08:00
serial tty: serial: 8250_core.c Bug fix for Exar chips. 2014-05-03 18:13:05 -04:00
vt vt: detect and ignore OSC codes. 2014-02-28 16:25:47 -08:00
amiserial.c tty/amiserial: avoid interruptible_sleep_on 2014-01-07 17:05:21 -08:00
bfin_jtag_comm.c TTY: bfin_jtag_comm: fix incorrect placement of __initdata tag 2013-09-30 19:09:37 -07:00
cyclades.c tty: an overflow of multiplication in drivers/tty/cyclades.c 2013-12-20 12:21:57 -08:00
ehv_bytechan.c drivers: clean-up prom.h implicit includes 2013-10-09 20:04:04 -05:00
goldfish.c tty: delete non-required instances of include <linux/init.h> 2014-01-07 17:05:21 -08:00
isicom.c TTY: switch tty_flip_buffer_push 2013-01-15 22:30:15 -08:00
Kconfig drivers/tty: ehv_bytechan fails to build as a module 2014-01-09 17:52:12 -06:00
Makefile tty: Add timed, writer-prioritized rw semaphore 2013-05-20 12:30:32 -07:00
metag_da.c tree-wide: use reinit_completion instead of INIT_COMPLETION 2013-11-15 09:32:21 +09:00
moxa.c TTY: add tty_port_tty_hangup helper 2013-03-18 16:24:29 -07:00
moxa.h
mxser.c tty: mxser: Fix build warning introduced by dfc7b837c7 (Re: linux-next: build warning after merge of the tty.current tree) 2013-05-22 10:26:02 -07:00
mxser.h
n_gsm.c tty: n_gsm: Fix for modems with brk in modem status control 2014-02-07 08:40:54 -08:00
n_hdlc.c
n_r3964.c tty: Always handle NULL flag ptr 2013-12-08 16:56:05 -08:00
n_tracerouter.c
n_tracesink.c
n_tracesink.h
n_tty.c n_tty: Fix n_tty_write crash when echoing in raw mode 2014-05-03 18:13:05 -04:00
nozomi.c tty: Remove unnecessary semicolons 2013-10-16 13:08:16 -07:00
pty.c tty: Fix lock order in tty_do_resize() 2013-07-24 15:12:53 -07:00
rocket_int.h
rocket.c tty: remove DEFINE_PCI_DEVICE_TABLE macro 2013-12-08 17:09:07 -08:00
rocket.h
synclink_gt.c tty: synclink: avoid sleep_on race 2014-01-07 17:05:21 -08:00
synclink.c synclink: fix info leak in ioctl 2014-03-17 16:13:23 -07:00
synclinkmp.c synclink: fix info leak in ioctl 2014-03-17 16:13:23 -07:00
sysrq.c sysrq: Allow magic SysRq key functions to be disabled through Kconfig 2013-10-16 13:01:44 -07:00
tty_audit.c audit: anchor all pid references in the initial pid namespace 2014-03-20 10:11:55 -04:00
tty_buffer.c tty: Fix lockless tty buffer race 2014-05-03 18:14:28 -04:00
tty_io.c tty: fix memleak in alloc_pid 2014-04-16 14:31:13 -07:00
tty_ioctl.c tty: Fix SIGTTOU not sent with tcflush() 2013-09-25 17:52:17 -07:00
tty_ldisc.c tty: delete non-required instances of include <linux/init.h> 2014-01-07 17:05:21 -08:00
tty_ldsem.c lockdep: Make held_lock->check and "int check" argument bool 2014-02-09 21:18:54 +01:00
tty_mutex.c tty: tty_mutex.c: Fixed coding style warning (using printk) 2012-10-24 11:34:51 -07:00
tty_port.c tty: delete non-required instances of include <linux/init.h> 2014-01-07 17:05:21 -08:00