n_tty: Fix echo race
svn path=/dists/trunk/linux-2.6/; revision=13989
This commit is contained in:
parent
1a05b498da
commit
6c9b302884
|
@ -38,6 +38,9 @@ linux-2.6 (2.6.31~rc3-1~experimental.1) UNRELEASED; urgency=low
|
||||||
[ Moritz Muehlenhoff ]
|
[ Moritz Muehlenhoff ]
|
||||||
* Fix Linus' name in copyright file (Closes: #530620)
|
* Fix Linus' name in copyright file (Closes: #530620)
|
||||||
|
|
||||||
|
[ dann frazier ]
|
||||||
|
* n_tty: Fix echo race
|
||||||
|
|
||||||
-- maximilian attems <maks@debian.org> Thu, 18 Jun 2009 23:50:56 +0200
|
-- maximilian attems <maks@debian.org> Thu, 18 Jun 2009 23:50:56 +0200
|
||||||
|
|
||||||
linux-2.6 (2.6.30-1) unstable; urgency=low
|
linux-2.6 (2.6.30-1) unstable; urgency=low
|
||||||
|
|
|
@ -0,0 +1,49 @@
|
||||||
|
commit 807708844979ba8c6d5717345a8608454992696d
|
||||||
|
Author: Alan Cox <alan@linux.intel.com>
|
||||||
|
Date: Thu Jul 16 16:07:03 2009 +0100
|
||||||
|
|
||||||
|
n_tty: Fix echo race
|
||||||
|
|
||||||
|
If a tty in N_TTY mode with echo enabled manages to get itself into a state
|
||||||
|
where
|
||||||
|
- echo characters are pending
|
||||||
|
- FASYNC is enabled
|
||||||
|
- tty_write_wakeup is called from either
|
||||||
|
- a device write path (pty)
|
||||||
|
- an IRQ (serial)
|
||||||
|
|
||||||
|
then it either deadlocks or explodes taking a mutex in the IRQ path.
|
||||||
|
|
||||||
|
On the serial side it is almost impossible to reproduce because you have to
|
||||||
|
go from a full serial port to a near empty one with echo characters
|
||||||
|
pending. The pty case happens to have become possible to trigger using
|
||||||
|
emacs and ptys, the pty changes having created a scenario which shows up
|
||||||
|
this bug.
|
||||||
|
|
||||||
|
The code path is
|
||||||
|
|
||||||
|
n_tty:process_echoes() (takes mutex)
|
||||||
|
tty_io:tty_put_char()
|
||||||
|
pty:pty_write (or serial paths)
|
||||||
|
tty_wakeup (from pty_write or serial IRQ)
|
||||||
|
n_tty_write_wakeup()
|
||||||
|
process_echoes()
|
||||||
|
*KABOOM*
|
||||||
|
|
||||||
|
Signed-off-by: Alan Cox <alan@linux.intel.com>
|
||||||
|
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
||||||
|
|
||||||
|
diff --git a/drivers/char/n_tty.c b/drivers/char/n_tty.c
|
||||||
|
index 94a5d50..ff47907 100644
|
||||||
|
--- a/drivers/char/n_tty.c
|
||||||
|
+++ b/drivers/char/n_tty.c
|
||||||
|
@@ -1331,9 +1331,6 @@ handle_newline:
|
||||||
|
|
||||||
|
static void n_tty_write_wakeup(struct tty_struct *tty)
|
||||||
|
{
|
||||||
|
- /* Write out any echoed characters that are still pending */
|
||||||
|
- process_echoes(tty);
|
||||||
|
-
|
||||||
|
if (tty->fasync && test_and_clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags))
|
||||||
|
kill_fasync(&tty->fasync, SIGIO, POLL_OUT);
|
||||||
|
}
|
|
@ -30,3 +30,4 @@
|
||||||
#+ bugfix/arm/export-flush_dcache_page.patch
|
#+ bugfix/arm/export-flush_dcache_page.patch
|
||||||
+ bugfix/all/add-missing-mtd-include.patch
|
+ bugfix/all/add-missing-mtd-include.patch
|
||||||
+ bugfix/mips/fix-smp.patch
|
+ bugfix/mips/fix-smp.patch
|
||||||
|
+ bugfix/all/n_tty-fix-echo-race.patch
|
||||||
|
|
Loading…
Reference in New Issue