]> git.baikalelectronics.ru Git - kernel.git/commit
tty: fix data race in tty_buffer_flush
authorDmitry Vyukov <dvyukov@google.com>
Thu, 17 Sep 2015 15:17:09 +0000 (17:17 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 4 Oct 2015 18:03:40 +0000 (19:03 +0100)
commit95569ea4f486fc6b702c2f82226801ff2fca81f1
tree04e1bc509bbb1dd5323c29df0c642a5cdbec161e
parentb8423cc289de2eb49cc6a05d11b2b94cbc5a0466
tty: fix data race in tty_buffer_flush

tty_buffer_flush frees not acquired buffers.
As the result, for example, read of b->size in tty_buffer_free
can return garbage value which will lead to a huge buffer
hanging in the freelist. This is just the benignest
manifestation of freeing of a not acquired object.
If the object is passed to kfree, heap can be corrupted.

Acquire visibility over the buffer before freeing it.

The data race was found with KernelThreadSanitizer (KTSAN).

Signed-off-by: Dmitry Vyukov <dvyukov@google.com>
Reviewed-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/tty/tty_buffer.c