• Dmitry Vyukov's avatar
    tty: fix data race in tty_ldisc_ref_wait() · a4a3e061
    Dmitry Vyukov authored
    
    
    tty_ldisc_ref_wait() checks tty->ldisc under tty->ldisc_sem.
    But if ldisc==NULL it releases them sem and reloads
    tty->ldisc without holding the sem. This is wrong and
    can lead to returning non-NULL ldisc without protection.
    
    Don't reload tty->ldisc second time.
    Signed-off-by: default avatarDmitry Vyukov <dvyukov@google.com>
    Cc: syzkaller@googlegroups.com
    Cc: linux-kernel@vger.kernel.org
    Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Cc: Jiri Slaby <jslaby@suse.com>
    Cc: Peter Hurley <peter@hurleysoftware.com>
    Cc: One Thousand Gnomes <gnomes@lxorguk.ukuu.org.uk>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    a4a3e061