diff options
| author |   Peter Hurley <peter@hurleysoftware.com> | 2013-06-15 07:28:30 -0400 |
|---|---|---|
| committer |   Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2013-06-17 12:55:30 -0700 |
| commit | b84830527645dfe7b7a5cc03518e3c791b4ee9e0 (patch) | |
| tree | ece65ac8c7dd14703870d6417d99f7f856eac4e8 /drivers/tty | |
| parent | n_tty: Untangle read completion variables (diff) | |
| download | linux-dev-b84830527645dfe7b7a5cc03518e3c791b4ee9e0.tar.xz linux-dev-b84830527645dfe7b7a5cc03518e3c791b4ee9e0.zip | |
n_tty: Fix unsafe update of available buffer space
receive_room is used to control the amount of data the flip
buffer work can push to the read buffer. This update is unsafe:
CPU 0 | CPU 1
|
| n_tty_read()
| n_tty_set_room()
| left = <calc of space>
n_tty_receive_buf() |
<push data to buffer> |
n_tty_set_room() |
left = <calc of space> |
tty->receive_room = left |
| tty->receive_room = left
receive_room is now updated with a stale calculation of the
available buffer space, and the subsequent work loop will likely
overwrite unread data in the input buffer.
Update receive_room atomically with the calculation of the
available buffer space.
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/tty')
| -rw-r--r-- | drivers/tty/n_tty.c | 18 |
1 files changed, 11 insertions, 7 deletions
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c index fa5cb4654c4f..064616542cb5 100644 --- a/drivers/tty/n_tty.c +++ b/drivers/tty/n_tty.c @@ -115,13 +115,14 @@ static inline int tty_put_user(struct tty_struct *tty, unsigned char x, } /** - * n_tty_set__room - receive space + * n_tty_set_room - receive space * @tty: terminal * - * Called by the driver to find out how much data it is - * permitted to feed to the line discipline without any being lost - * and thus to manage flow control. Not serialized. Answers for the - * "instant". + * Sets tty->receive_room to reflect the currently available space + * in the input buffer, and re-schedules the flip buffer work if space + * just became available. + * + * Locks: Concurrent update is protected with read_lock */ static void n_tty_set_room(struct tty_struct *tty) @@ -129,8 +130,10 @@ static void n_tty_set_room(struct tty_struct *tty) struct n_tty_data *ldata = tty->disc_data; int left; int old_left; + unsigned long flags; + + raw_spin_lock_irqsave(&ldata->read_lock, flags); - /* ldata->read_cnt is not read locked ? */ if (I_PARMRK(tty)) { /* Multiply read_cnt by 3, since each byte might take up to * three times as many spaces when PARMRK is set (depending on @@ -150,6 +153,8 @@ static void n_tty_set_room(struct tty_struct *tty) old_left = tty->receive_room; tty->receive_room = left; + raw_spin_unlock_irqrestore(&ldata->read_lock, flags); + /* Did this open up the receive buffer? We may need to flip */ if (left && !old_left) { WARN_RATELIMIT(tty->port->itty == NULL, @@ -1872,7 +1877,6 @@ do_it_again: retval = -ERESTARTSYS; break; } - /* FIXME: does n_tty_set_room need locking ? */ n_tty_set_room(tty); timeout = schedule_timeout(timeout); continue; |