[PATCH] tty: n_tty: Protect poll input checks against termios changes

[PATCH] tty: n_tty: Protect poll input checks against termios changes

[Zhu Jun]

n_tty_poll() calls input_available_p() without holding termios_rwsem.
It can therefore race with n_tty_set_termios() changing the canonical
mode and resetting the buffer indices. In particular, the availability
check can combine one input mode with indices from the other mode.

Take the read side of termios_rwsem for each poll input check, as the
read path already does. Release it before flushing the receive worker,
since that worker also needs termios_rwsem.

Fixes: 1da177e4c3f41 ("Linux-2.6.12-rc2")
Signed-off-by: Zhu Jun <zhujun2@cmss.chinamobile.com>
---
 drivers/tty/n_tty.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index e6a0f5b40d0a..115bc4a67e8a 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -2416,6 +2416,12 @@ static ssize_t n_tty_write(struct tty_struct *tty, struct file *file,
 	return (b - buf) ? b - buf : retval;
 }
 
+static bool n_tty_poll_input(struct tty_struct *tty)
+{
+	guard(rwsem_read)(&tty->termios_rwsem);
+	return input_available_p(tty, 1);
+}
+
 /**
  * n_tty_poll		-	poll method for N_TTY
  * @tty: terminal device
@@ -2437,11 +2443,11 @@ static __poll_t n_tty_poll(struct tty_struct *tty, struct file *file,
 
 	poll_wait(file, &tty->read_wait, wait);
 	poll_wait(file, &tty->write_wait, wait);
-	if (input_available_p(tty, 1))
+	if (n_tty_poll_input(tty)) {
 		mask |= EPOLLIN | EPOLLRDNORM;
-	else {
+	} else {
 		tty_buffer_flush_work(tty->port);
-		if (input_available_p(tty, 1))
+		if (n_tty_poll_input(tty))
 			mask |= EPOLLIN | EPOLLRDNORM;
 	}
 	if (tty->ctrl.packet && tty->link->ctrl.pktstatus)
-- 
2.51.0

Re: [PATCH] tty: n_tty: Protect poll input checks against termios changes

[sashiko-bot]

> n_tty_poll() calls input_available_p() without holding termios_rwsem.
> It can therefore race with n_tty_set_termios() changing the canonical
> mode and resetting the buffer indices. In particular, the availability
> check can combine one input mode with indices from the other mode.
> 
> Take the read side of termios_rwsem for each poll input check, as the
> read path already does. Release it before flushing the receive worker,
> since that worker also needs termios_rwsem.
> 
> Fixes: 1da177e4c3f41 ("Linux-2.6.12-rc2")
> Signed-off-by: Zhu Jun <zhujun2@cmss.chinamobile.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261111084116.80897-1-zhujun2@cmss.chinamobile.com?part=1