From: Jeongjun Park <aha310510@gmail.com>
To: gregkh@linuxfoundation.org, jirislaby@kernel.org
Cc: linux-kernel@vger.kernel.org, linux-serial@vger.kernel.org,
Jeongjun Park <aha310510@gmail.com>
Subject: [PATCH] n_tty: fix data race in n_tty_poll()
Date: Sun, 11 May 2025 01:38:27 +0900 [thread overview]
Message-ID: <20250510163828.21963-1-aha310510@gmail.com> (raw)
I found data-race in my fuzzer:
==================================================================
BUG: KCSAN: data-race in n_tty_poll / tty_set_termios
read to 0xffff8880116b4d14 of 4 bytes by task 5443 on cpu 0:
n_tty_poll+0xa4/0x4c0 drivers/tty/n_tty.c:2452
tty_poll+0x8f/0x100 drivers/tty/tty_io.c:2208
vfs_poll include/linux/poll.h:82 [inline]
select_poll_one fs/select.c:480 [inline]
do_select+0x95f/0x1030 fs/select.c:536
core_sys_select+0x284/0x6d0 fs/select.c:677
....
write to 0xffff8880116b4d08 of 44 bytes by task 14547 on cpu 1:
tty_set_termios+0xf9/0x500 drivers/tty/tty_ioctl.c:339
set_termios.part.0+0x3bc/0x4d0 drivers/tty/tty_ioctl.c:520
set_termios drivers/tty/tty_ioctl.c:454 [inline]
tty_mode_ioctl+0x2db/0xa00 drivers/tty/tty_ioctl.c:807
n_tty_ioctl_helper+0x4e/0x230 drivers/tty/tty_ioctl.c:986
n_tty_ioctl+0x67/0x230 drivers/tty/n_tty.c:2509
....
==================================================================
In n_tty_poll() we are doing a read on tty->termios but we are missing
rwsem lock, which causes a concurrency problem. To fix this, we need to
add rwsem lock at the appropriate location.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Jeongjun Park <aha310510@gmail.com>
---
drivers/tty/n_tty.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index 6af3f3a0b531..36b41374e1bd 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -2449,6 +2449,8 @@ static __poll_t n_tty_poll(struct tty_struct *tty, struct file *file,
poll_wait(file, &tty->read_wait, wait);
poll_wait(file, &tty->write_wait, wait);
+
+ down_read(&tty->termios_rwsem);
if (input_available_p(tty, 1))
mask |= EPOLLIN | EPOLLRDNORM;
else {
@@ -2456,6 +2458,8 @@ static __poll_t n_tty_poll(struct tty_struct *tty, struct file *file,
if (input_available_p(tty, 1))
mask |= EPOLLIN | EPOLLRDNORM;
}
+ up_read(&tty->termios_rwsem);
+
if (tty->ctrl.packet && tty->link->ctrl.pktstatus)
mask |= EPOLLPRI | EPOLLIN | EPOLLRDNORM;
if (test_bit(TTY_OTHER_CLOSED, &tty->flags))
--
next reply other threads:[~2025-05-10 16:38 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-05-10 16:38 Jeongjun Park [this message]
2025-05-12 6:21 ` [PATCH] n_tty: fix data race in n_tty_poll() kernel test robot
2025-05-21 11:27 ` Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250510163828.21963-1-aha310510@gmail.com \
--to=aha310510@gmail.com \
--cc=gregkh@linuxfoundation.org \
--cc=jirislaby@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-serial@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox