diff mbox series

n_tty: fix data race in n_tty_poll()

Message ID 20250510163828.21963-1-aha310510@gmail.com
State New
Headers show
Series n_tty: fix data race in n_tty_poll() | expand

Commit Message

Jeongjun Park May 10, 2025, 4:38 p.m. UTC 
I found data-race in my fuzzer:

==================================================================
BUG: KCSAN: data-race in n_tty_poll / tty_set_termios

read to 0xffff8880116b4d14 of 4 bytes by task 5443 on cpu 0:
 n_tty_poll+0xa4/0x4c0 drivers/tty/n_tty.c:2452
 tty_poll+0x8f/0x100 drivers/tty/tty_io.c:2208
 vfs_poll include/linux/poll.h:82 [inline]
 select_poll_one fs/select.c:480 [inline]
 do_select+0x95f/0x1030 fs/select.c:536
 core_sys_select+0x284/0x6d0 fs/select.c:677
....

write to 0xffff8880116b4d08 of 44 bytes by task 14547 on cpu 1:
 tty_set_termios+0xf9/0x500 drivers/tty/tty_ioctl.c:339
 set_termios.part.0+0x3bc/0x4d0 drivers/tty/tty_ioctl.c:520
 set_termios drivers/tty/tty_ioctl.c:454 [inline]
 tty_mode_ioctl+0x2db/0xa00 drivers/tty/tty_ioctl.c:807
 n_tty_ioctl_helper+0x4e/0x230 drivers/tty/tty_ioctl.c:986
 n_tty_ioctl+0x67/0x230 drivers/tty/n_tty.c:2509
....
==================================================================

In n_tty_poll() we are doing a read on tty->termios but we are missing
rwsem lock, which causes a concurrency problem. To fix this, we need to
add rwsem lock at the appropriate location.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Jeongjun Park <aha310510@gmail.com>
---
 drivers/tty/n_tty.c | 4 ++++
 1 file changed, 4 insertions(+)

--
diff mbox series

Patch

diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index 6af3f3a0b531..36b41374e1bd 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -2449,6 +2449,8 @@  static __poll_t n_tty_poll(struct tty_struct *tty, struct file *file,
 
 	poll_wait(file, &tty->read_wait, wait);
 	poll_wait(file, &tty->write_wait, wait);
+
+	down_read(&tty->termios_rwsem);
 	if (input_available_p(tty, 1))
 		mask |= EPOLLIN | EPOLLRDNORM;
 	else {
@@ -2456,6 +2458,8 @@  static __poll_t n_tty_poll(struct tty_struct *tty, struct file *file,
 		if (input_available_p(tty, 1))
 			mask |= EPOLLIN | EPOLLRDNORM;
 	}
+	up_read(&tty->termios_rwsem);
+
 	if (tty->ctrl.packet && tty->link->ctrl.pktstatus)
 		mask |= EPOLLPRI | EPOLLIN | EPOLLRDNORM;
 	if (test_bit(TTY_OTHER_CLOSED, &tty->flags))