[PATCH] tty: n_tty: fix KCSAN data-race in n_tty_flush_buffer / n_tty_lookahead_flow_ctrl

[Osama Abdelkader]

n_tty_lookahead_flow_ctrl() accesses ldata->lookahead_count without
holding termios_rwsem, while reset_buffer_flags() in n_tty_flush_buffer()
resets it with exclusive termios_rwsem held. This causes a data race
reported by KCSAN when a PTY is closed while flush_to_ldisc is still
processing lookahead data.

Fix by taking termios_rwsem (read) in n_tty_lookahead_flow_ctrl(),
consistent with __receive_buf() which also modifies lookahead_count
under the read lock.

Reported-by: syzbot+80806cf7508e92c7cc86@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=80806cf7508e92c7cc86
Fixes: 6bb6fa6908eb ("tty: Implement lookahead to process XON/XOFF timely")
Signed-off-by: Osama Abdelkader <osama.abdelkader@xxxxxxxxx>
---
 drivers/tty/n_tty.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index e6a0f5b40d0a..725d6ed2b863 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -1480,6 +1480,8 @@ static void n_tty_lookahead_flow_ctrl(struct tty_struct *tty, const u8 *cp,
 	struct n_tty_data *ldata = tty->disc_data;
 	u8 flag = TTY_NORMAL;
 
+	guard(rwsem_read)(&tty->termios_rwsem);
+
 	ldata->lookahead_count += count;
 
 	if (!I_IXON(tty))
-- 
2.43.0