Re: [PATCH] tty: n_tty: fix KCSAN data-race in n_tty_flush_buffer / n_tty_lookahead_flow_ctrl

[Osama Abdelkader <osama.abdelkader@gmail.com>]

On Wed, Feb 11, 2026 at 10:08:38PM +0100, Osama Abdelkader wrote:
> n_tty_lookahead_flow_ctrl() accesses ldata->lookahead_count without
> holding termios_rwsem, while reset_buffer_flags() in n_tty_flush_buffer()
> resets it with exclusive termios_rwsem held. This causes a data race
> reported by KCSAN when a PTY is closed while flush_to_ldisc is still
> processing lookahead data.
> 
> Fix by taking termios_rwsem (read) in n_tty_lookahead_flow_ctrl(),
> consistent with __receive_buf() which also modifies lookahead_count
> under the read lock.
> 
> Reported-by: syzbot+80806cf7508e92c7cc86@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=80806cf7508e92c7cc86
> Fixes: 6bb6fa6908eb ("tty: Implement lookahead to process XON/XOFF timely")
> Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com>
> ---
>  drivers/tty/n_tty.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
> index e6a0f5b40d0a..725d6ed2b863 100644
> --- a/drivers/tty/n_tty.c
> +++ b/drivers/tty/n_tty.c
> @@ -1480,6 +1480,8 @@ static void n_tty_lookahead_flow_ctrl(struct tty_struct *tty, const u8 *cp,
>  	struct n_tty_data *ldata = tty->disc_data;
>  	u8 flag = TTY_NORMAL;
>  
> +	guard(rwsem_read)(&tty->termios_rwsem);
> +
>  	ldata->lookahead_count += count;
>  
>  	if (!I_IXON(tty))
> -- 
> 2.43.0
> 

ping