tty: Drop tty_mutex before tty reopen
[firefly-linux-kernel-4.4.55.git] / drivers / tty / tty_io.c
index c322e7af7373a82a0f80477d81abda17e5b8b600..66d6bcc24c7e38d853a1cb583a930c89d9f8c432 100644 (file)
@@ -153,8 +153,6 @@ static long tty_compat_ioctl(struct file *file, unsigned int cmd,
 static int __tty_fasync(int fd, struct file *filp, int on);
 static int tty_fasync(int fd, struct file *filp, int on);
 static void release_tty(struct tty_struct *tty, int idx);
-static void __proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
-static void proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
 
 /**
  *     free_tty_struct         -       free a disused tty
@@ -492,6 +490,78 @@ static const struct file_operations hung_up_tty_fops = {
 static DEFINE_SPINLOCK(redirect_lock);
 static struct file *redirect;
 
+
+void proc_clear_tty(struct task_struct *p)
+{
+       unsigned long flags;
+       struct tty_struct *tty;
+       spin_lock_irqsave(&p->sighand->siglock, flags);
+       tty = p->signal->tty;
+       p->signal->tty = NULL;
+       spin_unlock_irqrestore(&p->sighand->siglock, flags);
+       tty_kref_put(tty);
+}
+
+/**
+ * proc_set_tty -  set the controlling terminal
+ *
+ * Only callable by the session leader and only if it does not already have
+ * a controlling terminal.
+ *
+ * Caller must hold:  tty_lock()
+ *                   a readlock on tasklist_lock
+ *                   sighand lock
+ */
+static void __proc_set_tty(struct tty_struct *tty)
+{
+       unsigned long flags;
+
+       spin_lock_irqsave(&tty->ctrl_lock, flags);
+       /*
+        * The session and fg pgrp references will be non-NULL if
+        * tiocsctty() is stealing the controlling tty
+        */
+       put_pid(tty->session);
+       put_pid(tty->pgrp);
+       tty->pgrp = get_pid(task_pgrp(current));
+       spin_unlock_irqrestore(&tty->ctrl_lock, flags);
+       tty->session = get_pid(task_session(current));
+       if (current->signal->tty) {
+               printk(KERN_DEBUG "tty not NULL!!\n");
+               tty_kref_put(current->signal->tty);
+       }
+       put_pid(current->signal->tty_old_pgrp);
+       current->signal->tty = tty_kref_get(tty);
+       current->signal->tty_old_pgrp = NULL;
+}
+
+static void proc_set_tty(struct tty_struct *tty)
+{
+       spin_lock_irq(&current->sighand->siglock);
+       __proc_set_tty(tty);
+       spin_unlock_irq(&current->sighand->siglock);
+}
+
+struct tty_struct *get_current_tty(void)
+{
+       struct tty_struct *tty;
+       unsigned long flags;
+
+       spin_lock_irqsave(&current->sighand->siglock, flags);
+       tty = tty_kref_get(current->signal->tty);
+       spin_unlock_irqrestore(&current->sighand->siglock, flags);
+       return tty;
+}
+EXPORT_SYMBOL_GPL(get_current_tty);
+
+static void session_clear_tty(struct pid *session)
+{
+       struct task_struct *p;
+       do_each_pid_task(session, PIDTYPE_SID, p) {
+               proc_clear_tty(p);
+       } while_each_pid_task(session, PIDTYPE_SID, p);
+}
+
 /**
  *     tty_wakeup      -       request more data
  *     @tty: terminal
@@ -620,9 +690,6 @@ static void __tty_hangup(struct tty_struct *tty, int exit_session)
                return;
        }
 
-       /* some functions below drop BTM, so we need this bit */
-       set_bit(TTY_HUPPING, &tty->flags);
-
        /* inuse_filps is protected by the single tty lock,
           this really needs to change if we want to flush the
           workqueue with the lock held */
@@ -647,10 +714,6 @@ static void __tty_hangup(struct tty_struct *tty, int exit_session)
        while (refs--)
                tty_kref_put(tty);
 
-       /*
-        * it drops BTM and thus races with reopen
-        * we protect the race by TTY_HUPPING
-        */
        tty_ldisc_hangup(tty);
 
        spin_lock_irq(&tty->ctrl_lock);
@@ -682,8 +745,6 @@ static void __tty_hangup(struct tty_struct *tty, int exit_session)
         * can't yet guarantee all that.
         */
        set_bit(TTY_HUPPED, &tty->flags);
-       clear_bit(TTY_HUPPING, &tty->flags);
-
        tty_unlock(tty);
 
        if (f)
@@ -792,14 +853,6 @@ int tty_hung_up_p(struct file *filp)
 
 EXPORT_SYMBOL(tty_hung_up_p);
 
-static void session_clear_tty(struct pid *session)
-{
-       struct task_struct *p;
-       do_each_pid_task(session, PIDTYPE_SID, p) {
-               proc_clear_tty(p);
-       } while_each_pid_task(session, PIDTYPE_SID, p);
-}
-
 /**
  *     disassociate_ctty       -       disconnect controlling tty
  *     @on_exit: true if exiting so need to "hang up" the session
@@ -1291,19 +1344,24 @@ static ssize_t tty_line_name(struct tty_driver *driver, int index, char *p)
  *     @driver: the driver for the tty
  *     @idx:    the minor number
  *
- *     Return the tty, if found or ERR_PTR() otherwise.
+ *     Return the tty, if found. If not found, return NULL or ERR_PTR() if the
+ *     driver lookup() method returns an error.
  *
- *     Locking: tty_mutex must be held. If tty is found, the mutex must
- *     be held until the 'fast-open' is also done. Will change once we
- *     have refcounting in the driver and per driver locking
+ *     Locking: tty_mutex must be held. If the tty is found, bump the tty kref.
  */
 static struct tty_struct *tty_driver_lookup_tty(struct tty_driver *driver,
                struct inode *inode, int idx)
 {
+       struct tty_struct *tty;
+
        if (driver->ops->lookup)
-               return driver->ops->lookup(driver, inode, idx);
+               tty = driver->ops->lookup(driver, inode, idx);
+       else
+               tty = driver->ttys[idx];
 
-       return driver->ttys[idx];
+       if (!IS_ERR(tty))
+               tty_kref_get(tty);
+       return tty;
 }
 
 /**
@@ -1391,29 +1449,21 @@ void tty_driver_remove_tty(struct tty_driver *driver, struct tty_struct *tty)
  *     @tty    - the tty to open
  *
  *     Return 0 on success, -errno on error.
+ *     Re-opens on master ptys are not allowed and return -EIO.
  *
- *     Locking: tty_mutex must be held from the time the tty was found
- *              till this open completes.
+ *     Locking: Caller must hold tty_lock
  */
 static int tty_reopen(struct tty_struct *tty)
 {
        struct tty_driver *driver = tty->driver;
 
-       if (test_bit(TTY_CLOSING, &tty->flags) ||
-                       test_bit(TTY_HUPPING, &tty->flags))
+       if (!tty->count)
                return -EIO;
 
        if (driver->type == TTY_DRIVER_TYPE_PTY &&
-           driver->subtype == PTY_TYPE_MASTER) {
-               /*
-                * special case for PTY masters: only one open permitted,
-                * and the slave side open count is incremented as well.
-                */
-               if (tty->count)
-                       return -EIO;
+           driver->subtype == PTY_TYPE_MASTER)
+               return -EIO;
 
-               tty->link->count++;
-       }
        tty->count++;
 
        WARN_ON(!tty->ldisc);
@@ -1890,20 +1940,20 @@ int tty_release(struct inode *inode, struct file *filp)
 }
 
 /**
- *     tty_open_current_tty - get tty of current task for open
+ *     tty_open_current_tty - get locked tty of current task
  *     @device: device number
  *     @filp: file pointer to tty
- *     @return: tty of the current task iff @device is /dev/tty
+ *     @return: locked tty of the current task iff @device is /dev/tty
+ *
+ *     Performs a re-open of the current task's controlling tty.
  *
  *     We cannot return driver and index like for the other nodes because
  *     devpts will not work then. It expects inodes to be from devpts FS.
- *
- *     We need to move to returning a refcounted object from all the lookup
- *     paths including this one.
  */
 static struct tty_struct *tty_open_current_tty(dev_t device, struct file *filp)
 {
        struct tty_struct *tty;
+       int retval;
 
        if (device != MKDEV(TTYAUX_MAJOR, 0))
                return NULL;
@@ -1914,9 +1964,14 @@ static struct tty_struct *tty_open_current_tty(dev_t device, struct file *filp)
 
        filp->f_flags |= O_NONBLOCK; /* Don't let /dev/tty block */
        /* noctty = 1; */
-       tty_kref_put(tty);
-       /* FIXME: we put a reference and return a TTY! */
-       /* This is only safe because the caller holds tty_mutex */
+       tty_lock(tty);
+       tty_kref_put(tty);      /* safe to drop the kref now */
+
+       retval = tty_reopen(tty);
+       if (retval < 0) {
+               tty_unlock(tty);
+               tty = ERR_PTR(retval);
+       }
        return tty;
 }
 
@@ -2014,13 +2069,9 @@ retry_open:
        index  = -1;
        retval = 0;
 
-       mutex_lock(&tty_mutex);
-       /* This is protected by the tty_mutex */
        tty = tty_open_current_tty(device, filp);
-       if (IS_ERR(tty)) {
-               retval = PTR_ERR(tty);
-               goto err_unlock;
-       } else if (!tty) {
+       if (!tty) {
+               mutex_lock(&tty_mutex);
                driver = tty_lookup_driver(device, filp, &noctty, &index);
                if (IS_ERR(driver)) {
                        retval = PTR_ERR(driver);
@@ -2033,21 +2084,25 @@ retry_open:
                        retval = PTR_ERR(tty);
                        goto err_unlock;
                }
-       }
 
-       if (tty) {
-               tty_lock(tty);
-               retval = tty_reopen(tty);
-               if (retval < 0) {
-                       tty_unlock(tty);
-                       tty = ERR_PTR(retval);
+               if (tty) {
+                       mutex_unlock(&tty_mutex);
+                       tty_lock(tty);
+                       /* safe to drop the kref from tty_driver_lookup_tty() */
+                       tty_kref_put(tty);
+                       retval = tty_reopen(tty);
+                       if (retval < 0) {
+                               tty_unlock(tty);
+                               tty = ERR_PTR(retval);
+                       }
+               } else { /* Returns with the tty_lock held for now */
+                       tty = tty_init_dev(driver, index);
+                       mutex_unlock(&tty_mutex);
                }
-       } else  /* Returns with the tty_lock held for now */
-               tty = tty_init_dev(driver, index);
 
-       mutex_unlock(&tty_mutex);
-       if (driver)
                tty_driver_kref_put(driver);
+       }
+
        if (IS_ERR(tty)) {
                retval = PTR_ERR(tty);
                goto err_file;
@@ -2094,20 +2149,18 @@ retry_open:
                goto retry_open;
        }
        clear_bit(TTY_HUPPED, &tty->flags);
-       tty_unlock(tty);
 
 
-       mutex_lock(&tty_mutex);
-       tty_lock(tty);
+       read_lock(&tasklist_lock);
        spin_lock_irq(&current->sighand->siglock);
        if (!noctty &&
            current->signal->leader &&
            !current->signal->tty &&
            tty->session == NULL)
-               __proc_set_tty(current, tty);
+               __proc_set_tty(tty);
        spin_unlock_irq(&current->sighand->siglock);
+       read_unlock(&tasklist_lock);
        tty_unlock(tty);
-       mutex_unlock(&tty_mutex);
        return 0;
 err_unlock:
        mutex_unlock(&tty_mutex);
@@ -2272,18 +2325,14 @@ static int tiocgwinsz(struct tty_struct *tty, struct winsize __user *arg)
 int tty_do_resize(struct tty_struct *tty, struct winsize *ws)
 {
        struct pid *pgrp;
-       unsigned long flags;
 
        /* Lock the tty */
        mutex_lock(&tty->winsize_mutex);
        if (!memcmp(ws, &tty->winsize, sizeof(*ws)))
                goto done;
-       /* Get the PID values and reference them so we can
-          avoid holding the tty ctrl lock while sending signals */
-       spin_lock_irqsave(&tty->ctrl_lock, flags);
-       pgrp = get_pid(tty->pgrp);
-       spin_unlock_irqrestore(&tty->ctrl_lock, flags);
 
+       /* Signal the foreground process group */
+       pgrp = tty_get_pgrp(tty);
        if (pgrp)
                kill_pgrp(pgrp, SIGWINCH, 1);
        put_pid(pgrp);
@@ -2392,7 +2441,7 @@ static int fionbio(struct file *file, int __user *p)
  *     leader to set this tty as the controlling tty for the session.
  *
  *     Locking:
- *             Takes tty_mutex() to protect tty instance
+ *             Takes tty_lock() to serialize proc_set_tty() for this tty
  *             Takes tasklist_lock internally to walk sessions
  *             Takes ->siglock() when updating signal->tty
  */
@@ -2400,10 +2449,13 @@ static int fionbio(struct file *file, int __user *p)
 static int tiocsctty(struct tty_struct *tty, int arg)
 {
        int ret = 0;
+
+       tty_lock(tty);
+       read_lock(&tasklist_lock);
+
        if (current->signal->leader && (task_session(current) == tty->session))
-               return ret;
+               goto unlock;
 
-       mutex_lock(&tty_mutex);
        /*
         * The process must be a session leader and
         * not have a controlling tty already.
@@ -2422,17 +2474,16 @@ static int tiocsctty(struct tty_struct *tty, int arg)
                        /*
                         * Steal it away
                         */
-                       read_lock(&tasklist_lock);
                        session_clear_tty(tty->session);
-                       read_unlock(&tasklist_lock);
                } else {
                        ret = -EPERM;
                        goto unlock;
                }
        }
-       proc_set_tty(current, tty);
+       proc_set_tty(tty);
 unlock:
-       mutex_unlock(&tty_mutex);
+       read_unlock(&tasklist_lock);
+       tty_unlock(tty);
        return ret;
 }
 
@@ -2457,6 +2508,27 @@ struct pid *tty_get_pgrp(struct tty_struct *tty)
 }
 EXPORT_SYMBOL_GPL(tty_get_pgrp);
 
+/*
+ * This checks not only the pgrp, but falls back on the pid if no
+ * satisfactory pgrp is found. I dunno - gdb doesn't work correctly
+ * without this...
+ *
+ * The caller must hold rcu lock or the tasklist lock.
+ */
+static struct pid *session_of_pgrp(struct pid *pgrp)
+{
+       struct task_struct *p;
+       struct pid *sid = NULL;
+
+       p = pid_task(pgrp, PIDTYPE_PGID);
+       if (p == NULL)
+               p = pid_task(pgrp, PIDTYPE_PID);
+       if (p != NULL)
+               sid = task_session(p);
+
+       return sid;
+}
+
 /**
  *     tiocgpgrp               -       get process group
  *     @tty: tty passed by user
@@ -2703,23 +2775,17 @@ static int tty_tiocgicount(struct tty_struct *tty, void __user *arg)
        return 0;
 }
 
-struct tty_struct *tty_pair_get_tty(struct tty_struct *tty)
+/*
+ * if pty, return the slave side (real_tty)
+ * otherwise, return self
+ */
+static struct tty_struct *tty_pair_get_tty(struct tty_struct *tty)
 {
        if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
            tty->driver->subtype == PTY_TYPE_MASTER)
                tty = tty->link;
        return tty;
 }
-EXPORT_SYMBOL(tty_pair_get_tty);
-
-struct tty_struct *tty_pair_get_pty(struct tty_struct *tty)
-{
-       if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
-           tty->driver->subtype == PTY_TYPE_MASTER)
-           return tty;
-       return tty->link;
-}
-EXPORT_SYMBOL(tty_pair_get_pty);
 
 /*
  * Split this up, as gcc can choke on it otherwise..
@@ -3432,59 +3498,6 @@ dev_t tty_devnum(struct tty_struct *tty)
 }
 EXPORT_SYMBOL(tty_devnum);
 
-void proc_clear_tty(struct task_struct *p)
-{
-       unsigned long flags;
-       struct tty_struct *tty;
-       spin_lock_irqsave(&p->sighand->siglock, flags);
-       tty = p->signal->tty;
-       p->signal->tty = NULL;
-       spin_unlock_irqrestore(&p->sighand->siglock, flags);
-       tty_kref_put(tty);
-}
-
-/* Called under the sighand lock */
-
-static void __proc_set_tty(struct task_struct *tsk, struct tty_struct *tty)
-{
-       if (tty) {
-               unsigned long flags;
-               /* We should not have a session or pgrp to put here but.... */
-               spin_lock_irqsave(&tty->ctrl_lock, flags);
-               put_pid(tty->session);
-               put_pid(tty->pgrp);
-               tty->pgrp = get_pid(task_pgrp(tsk));
-               spin_unlock_irqrestore(&tty->ctrl_lock, flags);
-               tty->session = get_pid(task_session(tsk));
-               if (tsk->signal->tty) {
-                       printk(KERN_DEBUG "tty not NULL!!\n");
-                       tty_kref_put(tsk->signal->tty);
-               }
-       }
-       put_pid(tsk->signal->tty_old_pgrp);
-       tsk->signal->tty = tty_kref_get(tty);
-       tsk->signal->tty_old_pgrp = NULL;
-}
-
-static void proc_set_tty(struct task_struct *tsk, struct tty_struct *tty)
-{
-       spin_lock_irq(&tsk->sighand->siglock);
-       __proc_set_tty(tsk, tty);
-       spin_unlock_irq(&tsk->sighand->siglock);
-}
-
-struct tty_struct *get_current_tty(void)
-{
-       struct tty_struct *tty;
-       unsigned long flags;
-
-       spin_lock_irqsave(&current->sighand->siglock, flags);
-       tty = tty_kref_get(current->signal->tty);
-       spin_unlock_irqrestore(&current->sighand->siglock, flags);
-       return tty;
-}
-EXPORT_SYMBOL_GPL(get_current_tty);
-
 void tty_default_fops(struct file_operations *fops)
 {
        *fops = tty_fops;