[PATCH] tty: n_tty: annotate lockless read of ldata->icanon in input_available_p()

[PATCH] tty: n_tty: annotate lockless read of ldata->icanon in input_available_p()

[Ziyu Zhang]

n_tty_poll() calls input_available_p() without holding termios_rwsem to
check input readiness for select()/poll(). input_available_p() reads
ldata->icanon, which can be concurrently written by n_tty_set_termios()
under down_write(termios_rwsem).

This is a benign race: poll/select readiness is best-effort, and the
actual n_tty_read() path re-checks icanon under down_read(termios_rwsem).
A stale icanon value in poll only causes a transiently incorrect
readiness result, which is permitted by POSIX poll/select semantics.

Since icanon is a bitfield, READ_ONCE()/WRITE_ONCE() cannot be used.
Annotate the read with data_race() to document the intentional lockless
access and suppress data race detector warnings.

Signed-off-by: Ziyu Zhang <ziyuzhang201@gmail.com>
---
 drivers/tty/n_tty.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index e6a0f5b40..aa3c11623 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -1909,7 +1909,8 @@ static inline int input_available_p(const struct tty_struct *tty, int poll)
 	const struct n_tty_data *ldata = tty->disc_data;
 	int amt = poll && !TIME_CHAR(tty) && MIN_CHAR(tty) ? MIN_CHAR(tty) : 1;
 
-	if (ldata->icanon && !L_EXTPROC(tty))
+	/* data_race: benign race, poll readiness is best-effort */
+	if (data_race(ldata->icanon) && !L_EXTPROC(tty))
 		return ldata->canon_head != ldata->read_tail;
 	else
 		return ldata->commit_head - ldata->read_tail >= amt;
-- 
2.39.5 (Apple Git-154)

Re: [PATCH] tty: n_tty: annotate lockless read of ldata->icanon in input_available_p()

[kernel test robot]

Hi Ziyu,

kernel test robot noticed the following build errors:

[auto build test ERROR on tty/tty-testing]
[also build test ERROR on tty/tty-next tty/tty-linus linus/master v6.16-rc1 next-20260316]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Ziyu-Zhang/tty-n_tty-annotate-lockless-read-of-ldata-icanon-in-input_available_p/20260316-224221
base:   https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git tty-testing
patch link:    https://lore.kernel.org/r/20260316132827.17855-1-ziyuzhang201%40gmail.com
patch subject: [PATCH] tty: n_tty: annotate lockless read of ldata->icanon in input_available_p()
config: x86_64-kexec (https://download.01.org/0day-ci/archive/20260316/202603162328.vY9JOJWL-lkp@intel.com/config)
compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260316/202603162328.vY9JOJWL-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202603162328.vY9JOJWL-lkp@intel.com/

All errors (new ones prefixed by >>):

>> drivers/tty/n_tty.c:1913:6: error: cannot pass bit-field as __auto_type initializer in C
    1913 |         if (data_race(ldata->icanon) && !L_EXTPROC(tty))
         |             ^
   include/linux/compiler.h:194:13: note: expanded from macro 'data_race'
     194 |         auto __v = (expr);                                              \
         |                    ^
   1 error generated.


vim +1913 drivers/tty/n_tty.c

  1906	
  1907	static inline int input_available_p(const struct tty_struct *tty, int poll)
  1908	{
  1909		const struct n_tty_data *ldata = tty->disc_data;
  1910		int amt = poll && !TIME_CHAR(tty) && MIN_CHAR(tty) ? MIN_CHAR(tty) : 1;
  1911	
  1912		/* data_race: benign race, poll readiness is best-effort */
> 1913		if (data_race(ldata->icanon) && !L_EXTPROC(tty))
  1914			return ldata->canon_head != ldata->read_tail;
  1915		else
  1916			return ldata->commit_head - ldata->read_tail >= amt;
  1917	}
  1918	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki