[kernel] r13989 - in dists/trunk/linux-2.6/debian: . patches/bugfix/all patches/series

[Dann Frazier]

Author: dannf
Date: Wed Jul 22 06:48:44 2009
New Revision: 13989

Log:
n_tty: Fix echo race

Added:
   dists/trunk/linux-2.6/debian/patches/bugfix/all/n_tty-fix-echo-race.patch
Modified:
   dists/trunk/linux-2.6/debian/changelog
   dists/trunk/linux-2.6/debian/patches/series/base

Modified: dists/trunk/linux-2.6/debian/changelog
==============================================================================
--- dists/trunk/linux-2.6/debian/changelog	Tue Jul 21 11:20:10 2009	(r13988)
+++ dists/trunk/linux-2.6/debian/changelog	Wed Jul 22 06:48:44 2009	(r13989)
@@ -38,6 +38,9 @@
   [ Moritz Muehlenhoff ]
   * Fix Linus' name in copyright file (Closes: #530620)
 
+  [ dann frazier ]
+  * n_tty: Fix echo race
+
  -- maximilian attems <maks at debian.org>  Thu, 18 Jun 2009 23:50:56 +0200
 
 linux-2.6 (2.6.30-1) unstable; urgency=low

Added: dists/trunk/linux-2.6/debian/patches/bugfix/all/n_tty-fix-echo-race.patch
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ dists/trunk/linux-2.6/debian/patches/bugfix/all/n_tty-fix-echo-race.patch	Wed Jul 22 06:48:44 2009	(r13989)
@@ -0,0 +1,49 @@
+commit 807708844979ba8c6d5717345a8608454992696d
+Author: Alan Cox <alan at linux.intel.com>
+Date:   Thu Jul 16 16:07:03 2009 +0100
+
+    n_tty: Fix echo race
+    
+    If a tty in N_TTY mode with echo enabled manages to get itself into a state
+    where
+    	- echo characters are pending
+    	- FASYNC is enabled
+    	- tty_write_wakeup is called from either
+    		- a device write path (pty)
+    		- an IRQ (serial)
+    
+    then it either deadlocks or explodes taking a mutex in the IRQ path.
+    
+    On the serial side it is almost impossible to reproduce because you have to
+    go from a full serial port to a near empty one with echo characters
+    pending. The pty case happens to have become possible to trigger using
+    emacs and ptys, the pty changes having created a scenario which shows up
+    this bug.
+    
+    The code path is
+    
+    	n_tty:process_echoes() (takes mutex)
+    	tty_io:tty_put_char()
+    	pty:pty_write  (or serial paths)
+    	tty_wakeup     (from pty_write or serial IRQ)
+    	n_tty_write_wakeup()
+    	process_echoes()
+    	*KABOOM*
+    
+    Signed-off-by: Alan Cox <alan at linux.intel.com>
+    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
+
+diff --git a/drivers/char/n_tty.c b/drivers/char/n_tty.c
+index 94a5d50..ff47907 100644
+--- a/drivers/char/n_tty.c
++++ b/drivers/char/n_tty.c
+@@ -1331,9 +1331,6 @@ handle_newline:
+ 
+ static void n_tty_write_wakeup(struct tty_struct *tty)
+ {
+-	/* Write out any echoed characters that are still pending */
+-	process_echoes(tty);
+-
+ 	if (tty->fasync && test_and_clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags))
+ 		kill_fasync(&tty->fasync, SIGIO, POLL_OUT);
+ }

Modified: dists/trunk/linux-2.6/debian/patches/series/base
==============================================================================
--- dists/trunk/linux-2.6/debian/patches/series/base	Tue Jul 21 11:20:10 2009	(r13988)
+++ dists/trunk/linux-2.6/debian/patches/series/base	Wed Jul 22 06:48:44 2009	(r13989)
@@ -30,3 +30,4 @@
 #+ bugfix/arm/export-flush_dcache_page.patch
 + bugfix/all/add-missing-mtd-include.patch
 + bugfix/mips/fix-smp.patch
++ bugfix/all/n_tty-fix-echo-race.patch