The data race is found with KernelThreadSanitizer (on rev 21bdb584af8c):
ThreadSanitizer: data-race in release_tty
Write of size 8 by thread T325 (K2579):
release_tty+0xf3/0x1c0 drivers/tty/tty_io.c:1688
tty_release+0x698/0x7c0 drivers/tty/tty_io.c:1920
__fput+0x15f/0x310 fs/file_table.c:207
____fput+0x1d/0x30 fs/file_table.c:243
task_work_run+0x115/0x130 kernel/task_work.c:123
do_notify_resume+0x73/0x80
tracehook_notify_resume include/linux/tracehook.h:190
do_notify_resume+0x73/0x80 arch/x86/kernel/signal.c:757
int_signal+0x12/0x17 arch/x86/entry/entry_64.S:326
Previous read of size 8 by thread T19 (K16):
flush_to_ldisc+0x29/0x300 drivers/tty/tty_buffer.c:472
process_one_work+0x47e/0x930 kernel/workqueue.c:2036
worker_thread+0xb0/0x900 kernel/workqueue.c:2170
kthread+0x150/0x170 kernel/kthread.c:207
flush_to_ldisc reads port->itty and checks that it is not NULL,
concurrently release_tty sets port->itty to NULL. It is possible
that flush_to_ldisc loads port->itty once, ensures that it is
not NULL, but then reloads it again and uses. The second load
can already return NULL, which will cause a crash.
Set port->itty to NULL after shutting down flush_to_ldisc work.
Signed-off-by: Dmitry Vyukov <dvyu...@google.com>
---
drivers/tty/tty_io.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 57fc6ee..0df24c1 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -1684,9 +1684,9 @@ static void release_tty(struct tty_struct *tty, int idx)
tty_free_termios(tty);
tty_driver_remove_tty(tty->driver, tty);
tty->port->itty = NULL;
+ cancel_work_sync(&tty->port->buf.work);
if (tty->link)
tty->link->port->itty = NULL;
- cancel_work_sync(&tty->port->buf.work);
tty_kref_put(tty->link);
tty_kref_put(tty);
--
2.5.0.457.gab17608
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
