Files
rockchip-kernel/include/linux
Manfred Schlaegl 6a20dbd6ca tty: Fix race condition between __tty_buffer_request_room and flush_to_ldisc
The race was introduced while development of linux-3.11 by
e8437d7ecb and
e9975fdec0.
Originally it was found and reproduced on linux-3.12.15 and
linux-3.12.15-rt25, by sending 500 byte blocks with 115kbaud to the
target uart in a loop with 100 milliseconds delay.

In short:
 1. The consumer flush_to_ldisc is on to remove the head tty_buffer.
 2. The producer adds a number of bytes, so that a new tty_buffer must
	be allocated and added by __tty_buffer_request_room.
 3. The consumer removes the head tty_buffer element, without handling
	newly committed data.

Detailed example:
 * Initial buffer:
   * Head, Tail -> 0: used=250; commit=250; read=240; next=NULL
 * Consumer: ''flush_to_ldisc''
   * consumed 10 Byte
   * buffer:
     * Head, Tail -> 0: used=250; commit=250; read=250; next=NULL
{{{
		count = head->commit - head->read;	// count = 0
		if (!count) {				// enter
			// INTERRUPTED BY PRODUCER ->
			if (head->next == NULL)
				break;
			buf->head = head->next;
			tty_buffer_free(port, head);
			continue;
		}
}}}
 * Producer: tty_insert_flip_... 10 bytes + tty_flip_buffer_push
   * buffer:
     * Head, Tail -> 0: used=250; commit=250; read=250; next=NULL
   * added 6 bytes: head-element filled to maximum.
     * buffer:
       * Head, Tail -> 0: used=256; commit=250; read=250; next=NULL
   * added 4 bytes: __tty_buffer_request_room is called
     * buffer:
       * Head -> 0: used=256; commit=256; read=250; next=1
       * Tail -> 1: used=4; commit=0; read=250 next=NULL
   * push (tty_flip_buffer_push)
     * buffer:
       * Head -> 0: used=256; commit=256; read=250; next=1
       * Tail -> 1: used=4; commit=4; read=250 next=NULL
 * Consumer
{{{
		count = head->commit - head->read;
		if (!count) {
			// INTERRUPTED BY PRODUCER <-
			if (head->next == NULL)		// -> no break
				break;
			buf->head = head->next;
			tty_buffer_free(port, head);
			// ERROR: tty_buffer head freed -> 6 bytes lost
			continue;
		}
}}}

This patch reintroduces a spin_lock to protect this case. Perhaps later
a lock-less solution could be found.

Signed-off-by: Manfred Schlaegl <manfred.schlaegl@gmx.at>
Cc: stable <stable@vger.kernel.org> # 3.11
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-04-24 15:18:02 -07:00
..
2014-03-28 20:42:01 +01:00
2014-02-15 10:58:17 +00:00
2014-03-28 16:29:35 -04:00
2014-04-18 16:40:08 -07:00
2013-12-23 18:34:58 -08:00
2014-01-24 22:39:54 +01:00
2013-11-15 09:32:21 +09:00
2013-11-09 00:16:29 -05:00
2014-03-11 11:52:47 +01:00
2014-04-03 16:20:58 -07:00
2014-04-01 17:08:43 +02:00
2014-02-13 10:08:52 +05:30
2014-01-16 10:23:02 +10:30
2014-04-01 23:19:14 -04:00
2014-03-10 11:44:42 -04:00
2014-03-11 22:52:43 -04:00
2014-03-10 17:26:19 -07:00
2014-02-20 14:54:28 +01:00
2014-03-04 07:55:47 -08:00
2014-01-16 11:15:50 +01:00
2014-04-07 16:36:07 -07:00
2013-12-29 16:34:25 -05:00
2014-03-07 11:41:32 -05:00
2014-02-19 17:22:44 +01:00
2014-04-17 12:30:40 -07:00
2014-03-13 12:11:00 +10:30
2014-01-25 08:55:09 +01:00
2014-04-03 16:20:50 -07:00
2014-02-13 20:21:59 -08:00
2013-12-11 15:52:34 +01:00
2014-02-28 15:36:37 -08:00
2013-12-26 13:29:35 -05:00
2014-04-01 23:19:08 -04:00
2014-03-04 13:51:06 -05:00
2014-01-27 21:02:39 -08:00
2013-11-09 00:16:19 -05:00
2014-04-01 23:19:10 -04:00
2014-03-17 15:14:16 -04:00
2014-03-17 15:15:21 -04:00
2014-01-25 03:14:05 -05:00
2014-04-07 10:59:19 -07:00
2014-01-13 14:29:49 -08:00
2014-04-03 16:21:04 -07:00
2014-03-19 15:11:19 -06:00
2014-03-19 22:24:08 -04:00
2014-02-17 15:01:52 -08:00
2014-03-09 19:53:45 +01:00
2014-01-28 13:20:09 -08:00
2014-04-01 17:08:43 +02:00
2013-12-19 19:09:38 -05:00
2014-01-27 21:02:39 -08:00
2014-02-15 11:55:28 -08:00
2014-02-17 15:01:37 -08:00
2014-04-07 16:35:53 -07:00
2014-01-30 16:56:55 -08:00