[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <4EB7BD9A.7070600@ilyx.ru>
Date: Mon, 07 Nov 2011 15:14:34 +0400
From: Ilya Zykov <ilya@...x.ru>
To: Alan Cox <alan@...ux.intel.com>
CC: Greg Kroah-Hartman <gregkh@...e.de>, linux-kernel@...r.kernel.org,
Ilya Zykov <ilya@...x.ru>
Subject: PROBLEM: Race condition in tty buffer's function flush_to_ldisc().
Function flush_to_ldisc() call disc->ops->receive_buf(),
without tty->buf.lock and with TTY_FLUSHING bit set.
If we have deferred TTY_FLUSHPENDING request,
another thread can grab tty->buf.lock, and
flush tty's buffer when receive_buf() use its.
Signed-off-by: Ilya Zykov <ilya@...x.ru>
---
diff -uprN -X ../../../dontdiff a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c
--- a/drivers/tty/tty_buffer.c 2011-11-07 14:30:46.000000000 +0400
+++ b/drivers/tty/tty_buffer.c 2011-11-07 14:35:32.000000000 +0400
@@ -427,11 +427,15 @@ static void flush_to_ldisc(struct work_s
tty_buffer_free(tty, head);
continue;
}
- /* Ldisc or user is trying to flush the buffers
- we are feeding to the ldisc, stop feeding the
- line discipline as we want to empty the queue */
- if (test_bit(TTY_FLUSHPENDING, &tty->flags))
+ /* Ldisc or user is trying to flush the buffers.
+ We may have a deferred request to flush the input buffer,
+ if so pull the chain under the lock and empty the queue */
+ if (test_bit(TTY_FLUSHPENDING, &tty->flags)) {
+ __tty_buffer_flush(tty);
+ clear_bit(TTY_FLUSHPENDING, &tty->flags);
+ wake_up(&tty->read_wait);
break;
+ }
if (!tty->receive_room)
break;
if (count > tty->receive_room)
@@ -447,13 +451,6 @@ static void flush_to_ldisc(struct work_s
clear_bit(TTY_FLUSHING, &tty->flags);
}
- /* We may have a deferred request to flush the input buffer,
- if so pull the chain under the lock and empty the queue */
- if (test_bit(TTY_FLUSHPENDING, &tty->flags)) {
- __tty_buffer_flush(tty);
- clear_bit(TTY_FLUSHPENDING, &tty->flags);
- wake_up(&tty->read_wait);
- }
spin_unlock_irqrestore(&tty->buf.lock, flags);
tty_ldisc_deref(disc);
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists