pty: Fix packet mode setting race

[firefly-linux-kernel-4.4.55.git] / drivers / tty / pty.c

diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
index 7c4447a5c0f4c07a9b552aa5229db29f57bf0d76..bcec4c71a408cd60832d1f1bcf4fdc32e174c777 100644 (file)
--- a/drivers/tty/pty.c
+++ b/drivers/tty/pty.c
@@ -178,21 +178,21 @@ static int pty_get_lock(struct tty_struct *tty, int __user *arg)
 /* Set the packet mode on a pty */
 static int pty_set_pktmode(struct tty_struct *tty, int __user *arg)
 {
-       unsigned long flags;
        int pktmode;
 
        if (get_user(pktmode, arg))
                return -EFAULT;
 
-       spin_lock_irqsave(&tty->ctrl_lock, flags);
+       spin_lock_irq(&tty->ctrl_lock);
        if (pktmode) {
                if (!tty->packet) {
-                       tty->packet = 1;
                        tty->link->ctrl_status = 0;
+                       smp_mb();
+                       tty->packet = 1;
                }
        } else
                tty->packet = 0;
-       spin_unlock_irqrestore(&tty->ctrl_lock, flags);
+       spin_unlock_irq(&tty->ctrl_lock);
 
        return 0;
 }
@@ -207,15 +207,12 @@ static int pty_get_pktmode(struct tty_struct *tty, int __user *arg)
 /* Send a signal to the slave */
 static int pty_signal(struct tty_struct *tty, int sig)
 {
-       unsigned long flags;
        struct pid *pgrp;
 
        if (tty->link) {
-               spin_lock_irqsave(&tty->link->ctrl_lock, flags);
-               pgrp = get_pid(tty->link->pgrp);
-               spin_unlock_irqrestore(&tty->link->ctrl_lock, flags);
-
-               kill_pgrp(pgrp, sig, 1);
+               pgrp = tty_get_pgrp(tty->link);
+               if (pgrp)
+                       kill_pgrp(pgrp, sig, 1);
                put_pid(pgrp);
        }
        return 0;
@@ -224,16 +221,15 @@ static int pty_signal(struct tty_struct *tty, int sig)
 static void pty_flush_buffer(struct tty_struct *tty)
 {
        struct tty_struct *to = tty->link;
-       unsigned long flags;
 
        if (!to)
                return;
        /* tty_buffer_flush(to); FIXME */
        if (to->packet) {
-               spin_lock_irqsave(&tty->ctrl_lock, flags);
+               spin_lock_irq(&tty->ctrl_lock);
                tty->ctrl_status |= TIOCPKT_FLUSHWRITE;
                wake_up_interruptible(&to->read_wait);
-               spin_unlock_irqrestore(&tty->ctrl_lock, flags);
+               spin_unlock_irq(&tty->ctrl_lock);
        }
 }
 
@@ -262,6 +258,32 @@ out:
 static void pty_set_termios(struct tty_struct *tty,
                                        struct ktermios *old_termios)
 {
+       /* See if packet mode change of state. */
+       if (tty->link && tty->link->packet) {
+               int extproc = (old_termios->c_lflag & EXTPROC) |
+                               (tty->termios.c_lflag & EXTPROC);
+               int old_flow = ((old_termios->c_iflag & IXON) &&
+                               (old_termios->c_cc[VSTOP] == '\023') &&
+                               (old_termios->c_cc[VSTART] == '\021'));
+               int new_flow = (I_IXON(tty) &&
+                               STOP_CHAR(tty) == '\023' &&
+                               START_CHAR(tty) == '\021');
+               if ((old_flow != new_flow) || extproc) {
+                       spin_lock_irq(&tty->ctrl_lock);
+                       if (old_flow != new_flow) {
+                               tty->ctrl_status &= ~(TIOCPKT_DOSTOP | TIOCPKT_NOSTOP);
+                               if (new_flow)
+                                       tty->ctrl_status |= TIOCPKT_DOSTOP;
+                               else
+                                       tty->ctrl_status |= TIOCPKT_NOSTOP;
+                       }
+                       if (extproc)
+                               tty->ctrl_status |= TIOCPKT_IOCTL;
+                       spin_unlock_irq(&tty->ctrl_lock);
+                       wake_up_interruptible(&tty->link->read_wait);
+               }
+       }
+
        tty->termios.c_cflag &= ~(CSIZE | PARENB);
        tty->termios.c_cflag |= (CS8 | CREAD);
 }
@@ -278,7 +300,6 @@ static void pty_set_termios(struct tty_struct *tty,
 static int pty_resize(struct tty_struct *tty,  struct winsize *ws)
 {
        struct pid *pgrp, *rpgrp;
-       unsigned long flags;
        struct tty_struct *pty = tty->link;
 
        /* For a PTY we need to lock the tty side */
@@ -286,17 +307,9 @@ static int pty_resize(struct tty_struct *tty,  struct winsize *ws)
        if (!memcmp(ws, &tty->winsize, sizeof(*ws)))
                goto done;
 
-       /* Get the PID values and reference them so we can
-          avoid holding the tty ctrl lock while sending signals.
-          We need to lock these individually however. */
-
-       spin_lock_irqsave(&tty->ctrl_lock, flags);
-       pgrp = get_pid(tty->pgrp);
-       spin_unlock_irqrestore(&tty->ctrl_lock, flags);
-
-       spin_lock_irqsave(&pty->ctrl_lock, flags);
-       rpgrp = get_pid(pty->pgrp);
-       spin_unlock_irqrestore(&pty->ctrl_lock, flags);
+       /* Signal the foreground process group of both ptys */
+       pgrp = tty_get_pgrp(tty);
+       rpgrp = tty_get_pgrp(pty);
 
        if (pgrp)
                kill_pgrp(pgrp, SIGWINCH, 1);
@@ -327,26 +340,26 @@ static void pty_start(struct tty_struct *tty)
 {
        unsigned long flags;
 
-       spin_lock_irqsave(&tty->ctrl_lock, flags);
        if (tty->link && tty->link->packet) {
+               spin_lock_irqsave(&tty->ctrl_lock, flags);
                tty->ctrl_status &= ~TIOCPKT_STOP;
                tty->ctrl_status |= TIOCPKT_START;
+               spin_unlock_irqrestore(&tty->ctrl_lock, flags);
                wake_up_interruptible_poll(&tty->link->read_wait, POLLIN);
        }
-       spin_unlock_irqrestore(&tty->ctrl_lock, flags);
 }
 
 static void pty_stop(struct tty_struct *tty)
 {
        unsigned long flags;
 
-       spin_lock_irqsave(&tty->ctrl_lock, flags);
        if (tty->link && tty->link->packet) {
+               spin_lock_irqsave(&tty->ctrl_lock, flags);
                tty->ctrl_status &= ~TIOCPKT_START;
                tty->ctrl_status |= TIOCPKT_STOP;
+               spin_unlock_irqrestore(&tty->ctrl_lock, flags);
                wake_up_interruptible_poll(&tty->link->read_wait, POLLIN);
        }
-       spin_unlock_irqrestore(&tty->ctrl_lock, flags);
 }
 
 /**
@@ -489,7 +502,6 @@ static const struct tty_operations master_pty_ops_bsd = {
        .flush_buffer = pty_flush_buffer,
        .chars_in_buffer = pty_chars_in_buffer,
        .unthrottle = pty_unthrottle,
-       .set_termios = pty_set_termios,
        .ioctl = pty_bsd_ioctl,
        .cleanup = pty_cleanup,
        .resize = pty_resize,
@@ -666,7 +678,6 @@ static const struct tty_operations ptm_unix98_ops = {
        .flush_buffer = pty_flush_buffer,
        .chars_in_buffer = pty_chars_in_buffer,
        .unthrottle = pty_unthrottle,
-       .set_termios = pty_set_termios,
        .ioctl = pty_unix98_ioctl,
        .resize = pty_resize,
        .shutdown = pty_unix98_shutdown,