Dmitry Vyukov 9e6b7cd7e7 tty: fix data race in tty_buffer_flush ... tty_buffer_flush frees not acquired buffers. As the result, for example, read of b->size in tty_buffer_free can return garbage value which will lead to a huge buffer hanging in the freelist. This is just the benignest manifestation of freeing of a not acquired object. If the object is passed to kfree, heap can be corrupted. Acquire visibility over the buffer before freeing it. The data race was found with KernelThreadSanitizer (KTSAN). Signed-off-by: Dmitry Vyukov <dvyukov@google.com> Reviewed-by: Peter Hurley <peter@hurleysoftware.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2015-10-04 19:03:40 +01:00
..
hvc	xen: MFN/GFN/BFN terminology changes for 4.3-rc0	2015-09-10 16:21:11 -07:00
ipwireless	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial	2015-04-14 09:50:27 -07:00
serial	serial: atmel: fix error path of probe function	2015-10-04 18:51:42 +01:00
vt	tty: vt: Fix !TASK_RUNNING diagnostic warning from paste_selection()	2015-07-23 18:08:29 -07:00
amiserial.c	tty: amiserial.c: move assignment out of if () block	2015-05-10 19:04:16 +02:00
bfin_jtag_comm.c	TTY: bfin_jtag_comm: remove incorrect wait_until_sent operation	2015-03-07 03:44:14 +01:00
cyclades.c	tty: remove buf parameter from tty_name()	2015-05-06 22:26:57 +02:00
ehv_bytechan.c	tty: remove unused variable sprop	2015-02-03 15:52:13 -08:00
goldfish.c	staging: goldfish: Fix pointer cast for 32 bits	2015-05-31 11:40:14 +09:00
isicom.c	tty/isicom: fix big-endian compile warning	2015-02-02 10:11:25 -08:00
Kconfig	ttyFDC: Implement KGDB IO operations.	2015-03-31 12:04:13 +02:00
Makefile	TTY: Add MIPS EJTAG Fast Debug Channel TTY driver	2015-03-31 12:04:12 +02:00
metag_da.c	tty/metag_da: Avoid module_init/module_exit in non-modular code	2015-06-16 14:12:31 -04:00
mips_ejtag_fdc.c	MIPS: Remove "weak" from get_c0_fdc_int() declaration	2015-09-03 12:07:38 +02:00
moxa.c	TTY: fix decimal printf format specifiers prefixed with 0x	2014-09-08 15:51:35 -07:00
moxa.h
mxser.c
mxser.h
n_gsm.c	tty: Convert use of __constant_htons to htons	2015-07-23 15:10:25 -07:00
n_hdlc.c	pty: Fix input race when closing	2015-05-10 19:26:37 +02:00
n_r3964.c
n_tracerouter.c
n_tracesink.c
n_tracesink.h
n_tty.c	tty: fix stall caused by missing memory barrier in drivers/tty/n_tty.c	2015-10-04 19:03:40 +01:00
nozomi.c	drivers/tty/nozomi.c: rename CONFIG_MAGIC	2015-05-10 19:19:06 +02:00
pty.c	pty: Add debug message for ptmx open	2015-07-23 18:37:32 -07:00
rocket_int.h
rocket.c	TTY: fix misspelling of current function in string	2015-01-09 14:38:15 -08:00
rocket.h	tty: rocket: fix comment of ROCKET_SPD_HI	2015-05-24 12:49:16 -07:00
synclink_gt.c	tty: synclink_gt.c: move assignment out of if () block	2015-05-10 19:04:18 +02:00
synclink.c	tty: synclink.c: move assignment out of if () block	2015-05-10 19:04:18 +02:00
synclinkmp.c	tty: synclinkmp.c: move assignment out of if () block	2015-05-10 19:04:18 +02:00
sysrq.c	mm, oom: pass an oom order of -1 when triggered by sysrq	2015-09-08 15:35:28 -07:00
tty_audit.c
tty_buffer.c	tty: fix data race in tty_buffer_flush	2015-10-04 19:03:40 +01:00
tty_io.c	tty: don't leak cdev in tty_cdev_add()	2015-10-04 18:51:42 +01:00
tty_ioctl.c	tty: Replace inline #ifdef TTY_DEBUG_WAIT_UNTIL_SENT	2015-07-23 18:37:31 -07:00
tty_ldisc.c	tty: core: Improve ldisc debug messages	2015-07-23 18:37:31 -07:00
tty_ldsem.c	tty: tty_ldsem.c: move assignment out of if () block	2015-05-10 19:04:18 +02:00
tty_mutex.c	tty: Make lock subclasses available for other tty locks	2015-02-02 10:11:27 -08:00
tty_port.c	tty: Deletion of unnecessary checks before two function calls	2014-11-26 19:35:49 -08:00