[PATCH] tty: pty: mark lockless flow control snapshots

[PATCH] tty: pty: mark lockless flow control snapshots

[Zhu Jun]

The PTY write and write-room callbacks inspect flow.stopped without
flow.lock, while TCXONC updates it under that lock. KCSAN reports the
write-room check racing with __stop_tty().

These callbacks take a snapshot of flow control: the state can change
again before a write, and the flip-buffer operations provide their own
serialization. Use data_race(READ_ONCE()) for both checks to document the
intentional race and ensure each check uses a single load.

Fixes: 1da177e4c3f41 ("Linux-2.6.12-rc2")
Signed-off-by: Zhu Jun <zhujun2@cmss.chinamobile.com>
---
 drivers/tty/pty.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
index 9a37008c4e91..5c605edb79a0 100644
--- a/drivers/tty/pty.c
+++ b/drivers/tty/pty.c
@@ -110,7 +110,8 @@ static ssize_t pty_write(struct tty_struct *tty, const u8 *buf, size_t c)
 {
 	struct tty_struct *to = tty->link;
 
-	if (tty->flow.stopped || !c)
+	/* Flow control may change concurrently under tty->flow.lock. */
+	if (data_race(READ_ONCE(tty->flow.stopped)) || !c)
 		return 0;
 
 	return tty_insert_flip_string_and_push_buffer(to->port, buf, c);
@@ -126,7 +127,8 @@ static ssize_t pty_write(struct tty_struct *tty, const u8 *buf, size_t c)
 
 static unsigned int pty_write_room(struct tty_struct *tty)
 {
-	if (tty->flow.stopped)
+	/* This is only a snapshot; flow control may change before a write. */
+	if (data_race(READ_ONCE(tty->flow.stopped)))
 		return 0;
 	return tty_buffer_space_avail(tty->link->port);
 }
-- 
2.51.0

Re: [PATCH] tty: pty: mark lockless flow control snapshots

[sashiko-bot]

> The PTY write and write-room callbacks inspect flow.stopped without
> flow.lock, while TCXONC updates it under that lock. KCSAN reports the
> write-room check racing with __stop_tty().
> 
> These callbacks take a snapshot of flow control: the state can change
> again before a write, and the flip-buffer operations provide their own
> serialization. Use data_race(READ_ONCE()) for both checks to document the
> intentional race and ensure each check uses a single load.
> 
> Fixes: 1da177e4c3f41 ("Linux-2.6.12-rc2")
> Signed-off-by: Zhu Jun <zhujun2@cmss.chinamobile.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261111064744.17235-1-zhujun2@cmss.chinamobile.com?part=1