Re: [syzbot] [kernel?] KCSAN: data-race in __fput / __tty_hangup (4)

[Tetsuo Handa]

On 2023/04/24 9:44, Al Viro wrote:
> Do you mean doing that in method instances that are present in tty_fops
> you mean doing that in method instances that are present in tty_fops
> and different in hung_up_tty_fops?

I meant, remove hung_up_tty_fops, and embed callbacks defined in hung_up_tty_fops into
tty_fops. For example, tty_read() (from "struct file_operations tty_fops"->read_iter)
will be changed like

 static ssize_t tty_read(struct kiocb *iocb, struct iov_iter *to)
 {
 	int i;
 	struct file *file = iocb->ki_filp;
 	struct inode *inode = file_inode(file);
 	struct tty_struct *tty = file_tty(file);
 	struct tty_ldisc *ld;
 
+	if (data_race(file->tty_hangup)) {
+		return hung_up_tty_read(iocb, to);
+	}
+
 	if (tty_paranoia_check(tty, inode, "tty_read"))
 		return -EIO;
 	if (!tty || tty_io_error(tty))
 		return -EIO;
 
 	/* We want to wait for the line discipline to sort out in this
 	 * situation.
 	 */
 	ld = tty_ldisc_ref_wait(tty);
 	if (!ld)
 		return hung_up_tty_read(iocb, to);
 	i = -EIO;
 	if (ld->ops->read)
 		i = iterate_tty_read(ld, tty, file, to);
 	tty_ldisc_deref(ld);
 
 	if (i > 0)
 		tty_update_time(&inode->i_atime);
 
 	return i;
 }

in order to avoid wrapping filp->f_op->* dereferences using data_race().