linux/include
Manfred Schlaegl 6a20dbd6ca tty: Fix race condition between __tty_buffer_request_room and flush_to_ldisc
The race was introduced while development of linux-3.11 by
e8437d7ecb and
e9975fdec0.
Originally it was found and reproduced on linux-3.12.15 and
linux-3.12.15-rt25, by sending 500 byte blocks with 115kbaud to the
target uart in a loop with 100 milliseconds delay.

In short:
 1. The consumer flush_to_ldisc is on to remove the head tty_buffer.
 2. The producer adds a number of bytes, so that a new tty_buffer must
	be allocated and added by __tty_buffer_request_room.
 3. The consumer removes the head tty_buffer element, without handling
	newly committed data.

Detailed example:
 * Initial buffer:
   * Head, Tail -> 0: used=250; commit=250; read=240; next=NULL
 * Consumer: ''flush_to_ldisc''
   * consumed 10 Byte
   * buffer:
     * Head, Tail -> 0: used=250; commit=250; read=250; next=NULL
{{{
		count = head->commit - head->read;	// count = 0
		if (!count) {				// enter
			// INTERRUPTED BY PRODUCER ->
			if (head->next == NULL)
				break;
			buf->head = head->next;
			tty_buffer_free(port, head);
			continue;
		}
}}}
 * Producer: tty_insert_flip_... 10 bytes + tty_flip_buffer_push
   * buffer:
     * Head, Tail -> 0: used=250; commit=250; read=250; next=NULL
   * added 6 bytes: head-element filled to maximum.
     * buffer:
       * Head, Tail -> 0: used=256; commit=250; read=250; next=NULL
   * added 4 bytes: __tty_buffer_request_room is called
     * buffer:
       * Head -> 0: used=256; commit=256; read=250; next=1
       * Tail -> 1: used=4; commit=0; read=250 next=NULL
   * push (tty_flip_buffer_push)
     * buffer:
       * Head -> 0: used=256; commit=256; read=250; next=1
       * Tail -> 1: used=4; commit=4; read=250 next=NULL
 * Consumer
{{{
		count = head->commit - head->read;
		if (!count) {
			// INTERRUPTED BY PRODUCER <-
			if (head->next == NULL)		// -> no break
				break;
			buf->head = head->next;
			tty_buffer_free(port, head);
			// ERROR: tty_buffer head freed -> 6 bytes lost
			continue;
		}
}}}

This patch reintroduces a spin_lock to protect this case. Perhaps later
a lock-less solution could be found.

Signed-off-by: Manfred Schlaegl <manfred.schlaegl@gmx.at>
Cc: stable <stable@vger.kernel.org> # 3.11
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-04-24 15:18:02 -07:00
..
acpi IOMMU Upates for Linux v3.15 2014-04-05 18:46:26 -07:00
asm-generic mm: use paravirt friendly ops for NUMA hinting ptes 2014-04-18 16:40:09 -07:00
clocksource
crypto crypto: export NULL algorithms defines 2014-03-21 21:54:26 +08:00
drm Merge branch 'drm-next-3.15-wip' of git://people.freedesktop.org/~deathsimple/linux into drm-next 2014-04-19 11:16:02 +10:00
dt-bindings The clock framework changes for 3.15 look similar to past pull requests. 2014-04-05 18:39:18 -07:00
keys
kvm ARM: KVM: fix non-VGIC compilation 2014-03-06 09:47:42 +01:00
linux tty: Fix race condition between __tty_buffer_request_room and flush_to_ldisc 2014-04-24 15:18:02 -07:00
math-emu
media [media] rc-core: remove generic scancode filter 2014-04-06 11:30:29 -03:00
memory
misc
net net: sctp: cache auth_enable per endpoint 2014-04-18 18:32:00 -04:00
pcmcia
ras
rdma Merge branches 'core', 'cxgb4', 'ip-roce', 'iser', 'misc', 'mlx4', 'nes', 'ocrdma', 'qib', 'sgwrapper', 'srp' and 'usnic' into for-next 2014-04-03 08:30:17 -07:00
rxrpc
scsi scsi: Make sure cmd_flags are 64-bit 2014-04-09 20:26:20 -06:00
sound ALSA: cs8427: separate HW initialization 2014-04-03 14:59:48 +02:00
target target/sbc: Add sbc_dif_read_strip software emulation 2014-04-07 01:48:57 -07:00
trace This includes the final patch to clean up and fix the issue with the 2014-04-12 13:06:10 -07:00
uapi Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux 2014-04-19 10:35:30 -07:00
video fbdev changes for 3.15 (OMAP) 2014-04-07 10:47:51 -07:00
xen xen/acpi-processor: fix enabling interrupts on syscore_resume 2014-03-18 14:40:20 +00:00
Kbuild