Manfred Schlaegl 6a20dbd6ca tty: Fix race condition between __tty_buffer_request_room and flush_to_ldisc ... The race was introduced while development of linux-3.11 by e8437d7ecb and e9975fdec0. Originally it was found and reproduced on linux-3.12.15 and linux-3.12.15-rt25, by sending 500 byte blocks with 115kbaud to the target uart in a loop with 100 milliseconds delay. In short: 1. The consumer flush_to_ldisc is on to remove the head tty_buffer. 2. The producer adds a number of bytes, so that a new tty_buffer must be allocated and added by __tty_buffer_request_room. 3. The consumer removes the head tty_buffer element, without handling newly committed data. Detailed example: * Initial buffer: * Head, Tail -> 0: used=250; commit=250; read=240; next=NULL * Consumer: ''flush_to_ldisc'' * consumed 10 Byte * buffer: * Head, Tail -> 0: used=250; commit=250; read=250; next=NULL {{{ count = head->commit - head->read; // count = 0 if (!count) { // enter // INTERRUPTED BY PRODUCER -> if (head->next == NULL) break; buf->head = head->next; tty_buffer_free(port, head); continue; } }}} * Producer: tty_insert_flip_... 10 bytes + tty_flip_buffer_push * buffer: * Head, Tail -> 0: used=250; commit=250; read=250; next=NULL * added 6 bytes: head-element filled to maximum. * buffer: * Head, Tail -> 0: used=256; commit=250; read=250; next=NULL * added 4 bytes: __tty_buffer_request_room is called * buffer: * Head -> 0: used=256; commit=256; read=250; next=1 * Tail -> 1: used=4; commit=0; read=250 next=NULL * push (tty_flip_buffer_push) * buffer: * Head -> 0: used=256; commit=256; read=250; next=1 * Tail -> 1: used=4; commit=4; read=250 next=NULL * Consumer {{{ count = head->commit - head->read; if (!count) { // INTERRUPTED BY PRODUCER <- if (head->next == NULL) // -> no break break; buf->head = head->next; tty_buffer_free(port, head); // ERROR: tty_buffer head freed -> 6 bytes lost continue; } }}} This patch reintroduces a spin_lock to protect this case. Perhaps later a lock-less solution could be found. Signed-off-by: Manfred Schlaegl <manfred.schlaegl@gmx.at> Cc: stable <stable@vger.kernel.org> # 3.11 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2014-04-24 15:18:02 -07:00
..
acpi	IOMMU Upates for Linux v3.15	2014-04-05 18:46:26 -07:00
asm-generic	mm: use paravirt friendly ops for NUMA hinting ptes	2014-04-18 16:40:09 -07:00
clocksource
crypto	crypto: export NULL algorithms defines	2014-03-21 21:54:26 +08:00
drm	Merge branch 'drm-next-3.15-wip' of git://people.freedesktop.org/~deathsimple/linux into drm-next	2014-04-19 11:16:02 +10:00
dt-bindings	The clock framework changes for 3.15 look similar to past pull requests.	2014-04-05 18:39:18 -07:00
keys
kvm
linux	tty: Fix race condition between __tty_buffer_request_room and flush_to_ldisc	2014-04-24 15:18:02 -07:00
math-emu
media	[media] rc-core: remove generic scancode filter	2014-04-06 11:30:29 -03:00
memory
misc
net	net: sctp: cache auth_enable per endpoint	2014-04-18 18:32:00 -04:00
pcmcia
ras
rdma	Merge branches 'core', 'cxgb4', 'ip-roce', 'iser', 'misc', 'mlx4', 'nes', 'ocrdma', 'qib', 'sgwrapper', 'srp' and 'usnic' into for-next	2014-04-03 08:30:17 -07:00
rxrpc
scsi	scsi: Make sure cmd_flags are 64-bit	2014-04-09 20:26:20 -06:00
sound	ALSA: cs8427: separate HW initialization	2014-04-03 14:59:48 +02:00
target	target/sbc: Add sbc_dif_read_strip software emulation	2014-04-07 01:48:57 -07:00
trace	This includes the final patch to clean up and fix the issue with the	2014-04-12 13:06:10 -07:00
uapi	Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux	2014-04-19 10:35:30 -07:00
video	fbdev changes for 3.15 (OMAP)	2014-04-07 10:47:51 -07:00
xen	xen/acpi-processor: fix enabling interrupts on syscore_resume	2014-03-18 14:40:20 +00:00
Kbuild