From 0a44ab41eb833d07e3ec807d87151c7164d4f075 Mon Sep 17 00:00:00 2001 From: Alan Cox Date: Fri, 22 Jun 2012 16:40:20 +0100 Subject: tty: note race we need to fix This was identified by Vincent Pillet with a high speed interface that uses low latency mode. In the low latency case we have a tiny race but it can be hit. Signed-off-by: Alan Cox Signed-off-by: Greg Kroah-Hartman --- drivers/tty/n_tty.c | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'drivers/tty/n_tty.c') diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c index ee1c268f5f9d..4f34491b65c6 100644 --- a/drivers/tty/n_tty.c +++ b/drivers/tty/n_tty.c @@ -1432,6 +1432,12 @@ static void n_tty_receive_buf(struct tty_struct *tty, const unsigned char *cp, */ if (tty->receive_room < TTY_THRESHOLD_THROTTLE) tty_throttle(tty); + + /* FIXME: there is a tiny race here if the receive room check runs + before the other work executes and empties the buffer (upping + the receiving room and unthrottling. We then throttle and get + stuck. This has been observed and traced down by Vincent Pillet/ + We need to address this when we sort out out the rx path locking */ } int is_ignored(int sig) -- cgit v1.2.3 From adc8d746caa67fff4b53ba3e5163a6cbacc3b523 Mon Sep 17 00:00:00 2001 From: Alan Cox Date: Sat, 14 Jul 2012 15:31:47 +0100 Subject: tty: move the termios object into the tty This will let us sort out a whole pile of tty related races. The alternative would be to keep points and refcount the termios objects. However 1. They are tiny anyway 2. Many devices don't use the stored copies 3. We can remove a pty special case Signed-off-by: Alan Cox Signed-off-by: Greg Kroah-Hartman --- drivers/tty/n_tty.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/tty/n_tty.c') diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c index 4f34491b65c6..101790cea4ae 100644 --- a/drivers/tty/n_tty.c +++ b/drivers/tty/n_tty.c @@ -1466,7 +1466,7 @@ static void n_tty_set_termios(struct tty_struct *tty, struct ktermios *old) BUG_ON(!tty); if (old) - canon_change = (old->c_lflag ^ tty->termios->c_lflag) & ICANON; + canon_change = (old->c_lflag ^ tty->termios.c_lflag) & ICANON; if (canon_change) { memset(&tty->read_flags, 0, sizeof tty->read_flags); tty->canon_head = tty->read_tail; -- cgit v1.2.3 From 00aaae033e323af33740e7012a8ba4b0fa6dce20 Mon Sep 17 00:00:00 2001 From: Stanislav Kozina Date: Thu, 9 Aug 2012 14:48:58 +0100 Subject: tty: Fix possible race in n_tty_read() Fix possible panic caused by unlocked access to tty->read_cnt in while-loop condition in n_tty_read(). Signed-off-by: Stanislav Kozina Signed-off-by: Alan Cox Signed-off-by: Greg Kroah-Hartman --- drivers/tty/n_tty.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'drivers/tty/n_tty.c') diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c index 101790cea4ae..20de673a7730 100644 --- a/drivers/tty/n_tty.c +++ b/drivers/tty/n_tty.c @@ -1838,13 +1838,13 @@ do_it_again: if (tty->icanon && !L_EXTPROC(tty)) { /* N.B. avoid overrun if nr == 0 */ + spin_lock_irqsave(&tty->read_lock, flags); while (nr && tty->read_cnt) { int eol; eol = test_and_clear_bit(tty->read_tail, tty->read_flags); c = tty->read_buf[tty->read_tail]; - spin_lock_irqsave(&tty->read_lock, flags); tty->read_tail = ((tty->read_tail+1) & (N_TTY_BUF_SIZE-1)); tty->read_cnt--; @@ -1862,15 +1862,19 @@ do_it_again: if (tty_put_user(tty, c, b++)) { retval = -EFAULT; b--; + spin_lock_irqsave(&tty->read_lock, flags); break; } nr--; } if (eol) { tty_audit_push(tty); + spin_lock_irqsave(&tty->read_lock, flags); break; } + spin_lock_irqsave(&tty->read_lock, flags); } + spin_unlock_irqrestore(&tty->read_lock, flags); if (retval) break; } else { -- cgit v1.2.3 From 090abf7b91645c1936ba959b1e1cd6d09110779c Mon Sep 17 00:00:00 2001 From: Jaeden Amero Date: Fri, 27 Jul 2012 08:43:11 -0500 Subject: n_tty: Don't lose characters when PARMRK is enabled When PARMRK is set and large transfers of characters that will get marked are being received, n_tty could drop data silently (i.e. without reporting any error to the client). This is because characters have the potential to take up to three bytes in the line discipline (when they get marked with parity or framing errors), but the amount of free space reported to tty_buffer flush_to_ldisc (via tty->receive_room) is based on the pre-marked data size. With this patch, the n_tty layer will no longer assume that each byte will only take up one byte in the line discipline. Instead, it will make an overly conservative estimate that each byte will take up three bytes in the line discipline when PARMRK is set. Signed-off-by: Jaeden Amero Acked-by: Alan Cox Signed-off-by: Greg Kroah-Hartman --- drivers/tty/n_tty.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) (limited to 'drivers/tty/n_tty.c') diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c index 20de673a7730..6259242b7858 100644 --- a/drivers/tty/n_tty.c +++ b/drivers/tty/n_tty.c @@ -92,10 +92,18 @@ static inline int tty_put_user(struct tty_struct *tty, unsigned char x, static void n_tty_set_room(struct tty_struct *tty) { - /* tty->read_cnt is not read locked ? */ - int left = N_TTY_BUF_SIZE - tty->read_cnt - 1; + int left; int old_left; + /* tty->read_cnt is not read locked ? */ + if (I_PARMRK(tty)) { + /* Multiply read_cnt by 3, since each byte might take up to + * three times as many spaces when PARMRK is set (depending on + * its flags, e.g. parity error). */ + left = N_TTY_BUF_SIZE - tty->read_cnt * 3 - 1; + } else + left = N_TTY_BUF_SIZE - tty->read_cnt - 1; + /* * If we are doing input canonicalization, and there are no * pending newlines, let characters through without limit, so -- cgit v1.2.3 From e9490e93c1978b6669f3e993caa3189be13ce459 Mon Sep 17 00:00:00 2001 From: Stanislav Kozina Date: Thu, 16 Aug 2012 12:01:47 +0100 Subject: Remove BUG_ON from n_tty_read() Change the BUG_ON to WARN_ON and return in case of tty->read_buf==NULL. We want to track a couple of long standing reports of this but at the same time we can avoid killing the box. Signed-off-by: Stanislav Kozina Signed-off-by: Alan Cox Cc: Horses Signed-off-by: Greg Kroah-Hartman --- drivers/tty/n_tty.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'drivers/tty/n_tty.c') diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c index 6259242b7858..8c0b7b42319c 100644 --- a/drivers/tty/n_tty.c +++ b/drivers/tty/n_tty.c @@ -1742,7 +1742,8 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file, do_it_again: - BUG_ON(!tty->read_buf); + if (WARN_ON(!tty->read_buf)) + return -EAGAIN; c = job_control(tty, file); if (c < 0) -- cgit v1.2.3