2008-07-22 18:16:55 +08:00
|
|
|
#include <linux/types.h>
|
|
|
|
|
#include <linux/major.h>
|
|
|
|
|
#include <linux/errno.h>
|
|
|
|
|
#include <linux/signal.h>
|
|
|
|
|
#include <linux/fcntl.h>
|
|
|
|
|
#include <linux/sched.h>
|
|
|
|
|
#include <linux/interrupt.h>
|
|
|
|
|
#include <linux/tty.h>
|
|
|
|
|
#include <linux/tty_driver.h>
|
|
|
|
|
#include <linux/tty_flip.h>
|
|
|
|
|
#include <linux/devpts_fs.h>
|
|
|
|
|
#include <linux/file.h>
|
|
|
|
|
#include <linux/console.h>
|
|
|
|
|
#include <linux/timer.h>
|
|
|
|
|
#include <linux/ctype.h>
|
|
|
|
|
#include <linux/kd.h>
|
|
|
|
|
#include <linux/mm.h>
|
|
|
|
|
#include <linux/string.h>
|
|
|
|
|
#include <linux/slab.h>
|
|
|
|
|
#include <linux/poll.h>
|
|
|
|
|
#include <linux/proc_fs.h>
|
|
|
|
|
#include <linux/init.h>
|
|
|
|
|
#include <linux/module.h>
|
|
|
|
|
#include <linux/device.h>
|
|
|
|
|
#include <linux/wait.h>
|
|
|
|
|
#include <linux/bitops.h>
|
|
|
|
|
#include <linux/delay.h>
|
|
|
|
|
#include <linux/seq_file.h>
|
|
|
|
|
|
|
|
|
|
#include <linux/uaccess.h>
|
|
|
|
|
#include <asm/system.h>
|
|
|
|
|
|
|
|
|
|
#include <linux/kbd_kern.h>
|
|
|
|
|
#include <linux/vt_kern.h>
|
|
|
|
|
#include <linux/selection.h>
|
|
|
|
|
|
|
|
|
|
#include <linux/kmod.h>
|
|
|
|
|
#include <linux/nsproxy.h>
|
|
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* This guards the refcounted line discipline lists. The lock
|
|
|
|
|
* must be taken with irqs off because there are hangup path
|
|
|
|
|
* callers who will do ldisc lookups and cannot sleep.
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
static DEFINE_SPINLOCK(tty_ldisc_lock);
|
|
|
|
|
static DECLARE_WAIT_QUEUE_HEAD(tty_ldisc_wait);
|
TTY: restore tty_ldisc_wait_idle
It was removed in 65b770468e98 (tty-ldisc: turn ldisc user count into
a proper refcount), but we need to wait for last user to quit the
ldisc before we close it in tty_set_ldisc.
Otherwise weird things start to happen. There might be processes
waiting in tty_read->n_tty_read on tty->read_wait for input to appear
and at that moment, a change of ldisc is fatal. n_tty_close is called,
it frees read_buf and the waiting process is still in the middle of
reading and goes nuts after it is woken.
Previously we prevented close to happen when others are in ldisc ops
by tty_ldisc_wait_idle in tty_set_ldisc. But the commit above removed
that. So revoke the change and test whether there is 1 user (=we), and
allow the close then.
We can do that without ldisc/tty locks, because nobody else can open
the device due to TTY_LDISC_CHANGING bit set, so we in fact wait for
everybody to leave.
I don't understand why tty_ldisc_lock would be needed either when the
counter is an atomic variable, so this is a lockless
tty_ldisc_wait_idle.
On the other hand, if we fail to wait (timeout or signal), we have to
reenable the halted ldiscs, so we take ldisc lock and reuse the setup
path at the end of tty_set_ldisc.
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Acked-by: Linus Torvalds <torvalds@linux-foundation.org>
Tested-by: Sebastian Andrzej Siewior <bigeasy@breakpoint.cc>
LKML-Reference: <20101031104136.GA511@Chamillionaire.breakpoint.cc>
LKML-Reference: <1287669539-22644-1-git-send-email-jslaby@suse.cz>
Cc: Alan Cox <alan@linux.intel.com>
Cc: stable@kernel.org [32, 33, 36]
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-11-01 06:17:51 +08:00
|
|
|
static DECLARE_WAIT_QUEUE_HEAD(tty_ldisc_idle);
|
2008-07-22 18:16:55 +08:00
|
|
|
/* Line disc dispatch table */
|
|
|
|
|
static struct tty_ldisc_ops *tty_ldiscs[NR_LDISCS];
|
|
|
|
|
|
tty-ldisc: turn ldisc user count into a proper refcount
By using the user count for the actual lifetime rules, we can get rid of
the silly "wait_for_idle" logic, because any busy ldisc will
automatically stay around until the last user releases it. This avoids
a host of odd issues, and simplifies the code.
So now, when the last ldisc reference is dropped, we just release the
ldisc operations struct reference, and free the ldisc.
It looks obvious enough, and it does work for me, but the counting
_could_ be off. It probably isn't (bad counting in the new version would
generally imply that the old code did something really bad, like free an
ldisc with a non-zero count), but it does need some testing, and
preferably somebody looking at it.
With this change, both 'tty_ldisc_put()' and 'tty_ldisc_deref()' are
just aliases for the new ref-counting 'put_ldisc()'. Both of them
decrement the ldisc user count and free it if it goes down to zero.
They're identical functions, in other words.
But the reason they still exist as sepate functions is that one of them
was exported (tty_ldisc_deref) and had a stupid name (so I don't want to
use it as the main name), and the other one was used in multiple places
(and I didn't want to make the patch larger just to rename the users).
In addition to the refcounting, I did do some minimal cleanup. For
example, now "tty_ldisc_try()" actually returns the ldisc it got under
the lock, rather than returning true/false and then the caller would
look up the ldisc again (now without the protection of the lock).
That said, there's tons of dubious use of 'tty->ldisc' without obviously
proper locking or refcounting left. I expressly did _not_ want to try to
fix it all, keeping the patch minimal. There may or may not be bugs in
that kind of code, but they wouldn't be _new_ bugs.
That said, even if the bugs aren't new, the timing and lifetime will
change. For example, some silly code may depend on the 'tty->ldisc'
pointer not changing because they hold a refcount on the 'ldisc'. And
that's no longer true - if you hold a ref on the ldisc, the 'ldisc'
itself is safe, but tty->ldisc may change.
So the proper locking (remains) to hold tty->ldisc_mutex if you expect
tty->ldisc to be stable. That's not really a _new_ rule, but it's an
example of something that the old code might have unintentionally
depended on and hidden bugs.
Whatever. The patch _looks_ sensible to me. The only users of
ldisc->users are:
- get_ldisc() - atomically increment the count
- put_ldisc() - atomically decrements the count and releases if zero
- tty_ldisc_try_get() - creates the ldisc, and sets the count to 1.
The ldisc should then either be released, or be attached to a tty.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Tested-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Tested-by: Sergey Senozhatsky <sergey.senozhatsky@mail.by>
Acked-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2009-08-04 02:11:19 +08:00
|
|
|
static inline struct tty_ldisc *get_ldisc(struct tty_ldisc *ld)
|
|
|
|
|
{
|
|
|
|
|
if (ld)
|
|
|
|
|
atomic_inc(&ld->users);
|
|
|
|
|
return ld;
|
|
|
|
|
}
|
|
|
|
|
|
2009-08-04 05:54:56 +08:00
|
|
|
static void put_ldisc(struct tty_ldisc *ld)
|
tty-ldisc: turn ldisc user count into a proper refcount
By using the user count for the actual lifetime rules, we can get rid of
the silly "wait_for_idle" logic, because any busy ldisc will
automatically stay around until the last user releases it. This avoids
a host of odd issues, and simplifies the code.
So now, when the last ldisc reference is dropped, we just release the
ldisc operations struct reference, and free the ldisc.
It looks obvious enough, and it does work for me, but the counting
_could_ be off. It probably isn't (bad counting in the new version would
generally imply that the old code did something really bad, like free an
ldisc with a non-zero count), but it does need some testing, and
preferably somebody looking at it.
With this change, both 'tty_ldisc_put()' and 'tty_ldisc_deref()' are
just aliases for the new ref-counting 'put_ldisc()'. Both of them
decrement the ldisc user count and free it if it goes down to zero.
They're identical functions, in other words.
But the reason they still exist as sepate functions is that one of them
was exported (tty_ldisc_deref) and had a stupid name (so I don't want to
use it as the main name), and the other one was used in multiple places
(and I didn't want to make the patch larger just to rename the users).
In addition to the refcounting, I did do some minimal cleanup. For
example, now "tty_ldisc_try()" actually returns the ldisc it got under
the lock, rather than returning true/false and then the caller would
look up the ldisc again (now without the protection of the lock).
That said, there's tons of dubious use of 'tty->ldisc' without obviously
proper locking or refcounting left. I expressly did _not_ want to try to
fix it all, keeping the patch minimal. There may or may not be bugs in
that kind of code, but they wouldn't be _new_ bugs.
That said, even if the bugs aren't new, the timing and lifetime will
change. For example, some silly code may depend on the 'tty->ldisc'
pointer not changing because they hold a refcount on the 'ldisc'. And
that's no longer true - if you hold a ref on the ldisc, the 'ldisc'
itself is safe, but tty->ldisc may change.
So the proper locking (remains) to hold tty->ldisc_mutex if you expect
tty->ldisc to be stable. That's not really a _new_ rule, but it's an
example of something that the old code might have unintentionally
depended on and hidden bugs.
Whatever. The patch _looks_ sensible to me. The only users of
ldisc->users are:
- get_ldisc() - atomically increment the count
- put_ldisc() - atomically decrements the count and releases if zero
- tty_ldisc_try_get() - creates the ldisc, and sets the count to 1.
The ldisc should then either be released, or be attached to a tty.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Tested-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Tested-by: Sergey Senozhatsky <sergey.senozhatsky@mail.by>
Acked-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2009-08-04 02:11:19 +08:00
|
|
|
{
|
2009-08-04 05:54:56 +08:00
|
|
|
unsigned long flags;
|
|
|
|
|
|
tty-ldisc: turn ldisc user count into a proper refcount
By using the user count for the actual lifetime rules, we can get rid of
the silly "wait_for_idle" logic, because any busy ldisc will
automatically stay around until the last user releases it. This avoids
a host of odd issues, and simplifies the code.
So now, when the last ldisc reference is dropped, we just release the
ldisc operations struct reference, and free the ldisc.
It looks obvious enough, and it does work for me, but the counting
_could_ be off. It probably isn't (bad counting in the new version would
generally imply that the old code did something really bad, like free an
ldisc with a non-zero count), but it does need some testing, and
preferably somebody looking at it.
With this change, both 'tty_ldisc_put()' and 'tty_ldisc_deref()' are
just aliases for the new ref-counting 'put_ldisc()'. Both of them
decrement the ldisc user count and free it if it goes down to zero.
They're identical functions, in other words.
But the reason they still exist as sepate functions is that one of them
was exported (tty_ldisc_deref) and had a stupid name (so I don't want to
use it as the main name), and the other one was used in multiple places
(and I didn't want to make the patch larger just to rename the users).
In addition to the refcounting, I did do some minimal cleanup. For
example, now "tty_ldisc_try()" actually returns the ldisc it got under
the lock, rather than returning true/false and then the caller would
look up the ldisc again (now without the protection of the lock).
That said, there's tons of dubious use of 'tty->ldisc' without obviously
proper locking or refcounting left. I expressly did _not_ want to try to
fix it all, keeping the patch minimal. There may or may not be bugs in
that kind of code, but they wouldn't be _new_ bugs.
That said, even if the bugs aren't new, the timing and lifetime will
change. For example, some silly code may depend on the 'tty->ldisc'
pointer not changing because they hold a refcount on the 'ldisc'. And
that's no longer true - if you hold a ref on the ldisc, the 'ldisc'
itself is safe, but tty->ldisc may change.
So the proper locking (remains) to hold tty->ldisc_mutex if you expect
tty->ldisc to be stable. That's not really a _new_ rule, but it's an
example of something that the old code might have unintentionally
depended on and hidden bugs.
Whatever. The patch _looks_ sensible to me. The only users of
ldisc->users are:
- get_ldisc() - atomically increment the count
- put_ldisc() - atomically decrements the count and releases if zero
- tty_ldisc_try_get() - creates the ldisc, and sets the count to 1.
The ldisc should then either be released, or be attached to a tty.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Tested-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Tested-by: Sergey Senozhatsky <sergey.senozhatsky@mail.by>
Acked-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2009-08-04 02:11:19 +08:00
|
|
|
if (WARN_ON_ONCE(!ld))
|
|
|
|
|
return;
|
|
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* If this is the last user, free the ldisc, and
|
|
|
|
|
* release the ldisc ops.
|
2009-08-04 05:54:56 +08:00
|
|
|
*
|
|
|
|
|
* We really want an "atomic_dec_and_lock_irqsave()",
|
|
|
|
|
* but we don't have it, so this does it by hand.
|
tty-ldisc: turn ldisc user count into a proper refcount
By using the user count for the actual lifetime rules, we can get rid of
the silly "wait_for_idle" logic, because any busy ldisc will
automatically stay around until the last user releases it. This avoids
a host of odd issues, and simplifies the code.
So now, when the last ldisc reference is dropped, we just release the
ldisc operations struct reference, and free the ldisc.
It looks obvious enough, and it does work for me, but the counting
_could_ be off. It probably isn't (bad counting in the new version would
generally imply that the old code did something really bad, like free an
ldisc with a non-zero count), but it does need some testing, and
preferably somebody looking at it.
With this change, both 'tty_ldisc_put()' and 'tty_ldisc_deref()' are
just aliases for the new ref-counting 'put_ldisc()'. Both of them
decrement the ldisc user count and free it if it goes down to zero.
They're identical functions, in other words.
But the reason they still exist as sepate functions is that one of them
was exported (tty_ldisc_deref) and had a stupid name (so I don't want to
use it as the main name), and the other one was used in multiple places
(and I didn't want to make the patch larger just to rename the users).
In addition to the refcounting, I did do some minimal cleanup. For
example, now "tty_ldisc_try()" actually returns the ldisc it got under
the lock, rather than returning true/false and then the caller would
look up the ldisc again (now without the protection of the lock).
That said, there's tons of dubious use of 'tty->ldisc' without obviously
proper locking or refcounting left. I expressly did _not_ want to try to
fix it all, keeping the patch minimal. There may or may not be bugs in
that kind of code, but they wouldn't be _new_ bugs.
That said, even if the bugs aren't new, the timing and lifetime will
change. For example, some silly code may depend on the 'tty->ldisc'
pointer not changing because they hold a refcount on the 'ldisc'. And
that's no longer true - if you hold a ref on the ldisc, the 'ldisc'
itself is safe, but tty->ldisc may change.
So the proper locking (remains) to hold tty->ldisc_mutex if you expect
tty->ldisc to be stable. That's not really a _new_ rule, but it's an
example of something that the old code might have unintentionally
depended on and hidden bugs.
Whatever. The patch _looks_ sensible to me. The only users of
ldisc->users are:
- get_ldisc() - atomically increment the count
- put_ldisc() - atomically decrements the count and releases if zero
- tty_ldisc_try_get() - creates the ldisc, and sets the count to 1.
The ldisc should then either be released, or be attached to a tty.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Tested-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Tested-by: Sergey Senozhatsky <sergey.senozhatsky@mail.by>
Acked-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2009-08-04 02:11:19 +08:00
|
|
|
*/
|
2009-08-04 05:54:56 +08:00
|
|
|
local_irq_save(flags);
|
|
|
|
|
if (atomic_dec_and_lock(&ld->users, &tty_ldisc_lock)) {
|
tty-ldisc: turn ldisc user count into a proper refcount
By using the user count for the actual lifetime rules, we can get rid of
the silly "wait_for_idle" logic, because any busy ldisc will
automatically stay around until the last user releases it. This avoids
a host of odd issues, and simplifies the code.
So now, when the last ldisc reference is dropped, we just release the
ldisc operations struct reference, and free the ldisc.
It looks obvious enough, and it does work for me, but the counting
_could_ be off. It probably isn't (bad counting in the new version would
generally imply that the old code did something really bad, like free an
ldisc with a non-zero count), but it does need some testing, and
preferably somebody looking at it.
With this change, both 'tty_ldisc_put()' and 'tty_ldisc_deref()' are
just aliases for the new ref-counting 'put_ldisc()'. Both of them
decrement the ldisc user count and free it if it goes down to zero.
They're identical functions, in other words.
But the reason they still exist as sepate functions is that one of them
was exported (tty_ldisc_deref) and had a stupid name (so I don't want to
use it as the main name), and the other one was used in multiple places
(and I didn't want to make the patch larger just to rename the users).
In addition to the refcounting, I did do some minimal cleanup. For
example, now "tty_ldisc_try()" actually returns the ldisc it got under
the lock, rather than returning true/false and then the caller would
look up the ldisc again (now without the protection of the lock).
That said, there's tons of dubious use of 'tty->ldisc' without obviously
proper locking or refcounting left. I expressly did _not_ want to try to
fix it all, keeping the patch minimal. There may or may not be bugs in
that kind of code, but they wouldn't be _new_ bugs.
That said, even if the bugs aren't new, the timing and lifetime will
change. For example, some silly code may depend on the 'tty->ldisc'
pointer not changing because they hold a refcount on the 'ldisc'. And
that's no longer true - if you hold a ref on the ldisc, the 'ldisc'
itself is safe, but tty->ldisc may change.
So the proper locking (remains) to hold tty->ldisc_mutex if you expect
tty->ldisc to be stable. That's not really a _new_ rule, but it's an
example of something that the old code might have unintentionally
depended on and hidden bugs.
Whatever. The patch _looks_ sensible to me. The only users of
ldisc->users are:
- get_ldisc() - atomically increment the count
- put_ldisc() - atomically decrements the count and releases if zero
- tty_ldisc_try_get() - creates the ldisc, and sets the count to 1.
The ldisc should then either be released, or be attached to a tty.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Tested-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Tested-by: Sergey Senozhatsky <sergey.senozhatsky@mail.by>
Acked-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2009-08-04 02:11:19 +08:00
|
|
|
struct tty_ldisc_ops *ldo = ld->ops;
|
|
|
|
|
|
|
|
|
|
ldo->refcount--;
|
|
|
|
|
module_put(ldo->owner);
|
|
|
|
|
spin_unlock_irqrestore(&tty_ldisc_lock, flags);
|
2009-08-04 05:54:56 +08:00
|
|
|
|
|
|
|
|
kfree(ld);
|
|
|
|
|
return;
|
tty-ldisc: turn ldisc user count into a proper refcount
By using the user count for the actual lifetime rules, we can get rid of
the silly "wait_for_idle" logic, because any busy ldisc will
automatically stay around until the last user releases it. This avoids
a host of odd issues, and simplifies the code.
So now, when the last ldisc reference is dropped, we just release the
ldisc operations struct reference, and free the ldisc.
It looks obvious enough, and it does work for me, but the counting
_could_ be off. It probably isn't (bad counting in the new version would
generally imply that the old code did something really bad, like free an
ldisc with a non-zero count), but it does need some testing, and
preferably somebody looking at it.
With this change, both 'tty_ldisc_put()' and 'tty_ldisc_deref()' are
just aliases for the new ref-counting 'put_ldisc()'. Both of them
decrement the ldisc user count and free it if it goes down to zero.
They're identical functions, in other words.
But the reason they still exist as sepate functions is that one of them
was exported (tty_ldisc_deref) and had a stupid name (so I don't want to
use it as the main name), and the other one was used in multiple places
(and I didn't want to make the patch larger just to rename the users).
In addition to the refcounting, I did do some minimal cleanup. For
example, now "tty_ldisc_try()" actually returns the ldisc it got under
the lock, rather than returning true/false and then the caller would
look up the ldisc again (now without the protection of the lock).
That said, there's tons of dubious use of 'tty->ldisc' without obviously
proper locking or refcounting left. I expressly did _not_ want to try to
fix it all, keeping the patch minimal. There may or may not be bugs in
that kind of code, but they wouldn't be _new_ bugs.
That said, even if the bugs aren't new, the timing and lifetime will
change. For example, some silly code may depend on the 'tty->ldisc'
pointer not changing because they hold a refcount on the 'ldisc'. And
that's no longer true - if you hold a ref on the ldisc, the 'ldisc'
itself is safe, but tty->ldisc may change.
So the proper locking (remains) to hold tty->ldisc_mutex if you expect
tty->ldisc to be stable. That's not really a _new_ rule, but it's an
example of something that the old code might have unintentionally
depended on and hidden bugs.
Whatever. The patch _looks_ sensible to me. The only users of
ldisc->users are:
- get_ldisc() - atomically increment the count
- put_ldisc() - atomically decrements the count and releases if zero
- tty_ldisc_try_get() - creates the ldisc, and sets the count to 1.
The ldisc should then either be released, or be attached to a tty.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Tested-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Tested-by: Sergey Senozhatsky <sergey.senozhatsky@mail.by>
Acked-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2009-08-04 02:11:19 +08:00
|
|
|
}
|
2009-08-04 05:54:56 +08:00
|
|
|
local_irq_restore(flags);
|
TTY: restore tty_ldisc_wait_idle
It was removed in 65b770468e98 (tty-ldisc: turn ldisc user count into
a proper refcount), but we need to wait for last user to quit the
ldisc before we close it in tty_set_ldisc.
Otherwise weird things start to happen. There might be processes
waiting in tty_read->n_tty_read on tty->read_wait for input to appear
and at that moment, a change of ldisc is fatal. n_tty_close is called,
it frees read_buf and the waiting process is still in the middle of
reading and goes nuts after it is woken.
Previously we prevented close to happen when others are in ldisc ops
by tty_ldisc_wait_idle in tty_set_ldisc. But the commit above removed
that. So revoke the change and test whether there is 1 user (=we), and
allow the close then.
We can do that without ldisc/tty locks, because nobody else can open
the device due to TTY_LDISC_CHANGING bit set, so we in fact wait for
everybody to leave.
I don't understand why tty_ldisc_lock would be needed either when the
counter is an atomic variable, so this is a lockless
tty_ldisc_wait_idle.
On the other hand, if we fail to wait (timeout or signal), we have to
reenable the halted ldiscs, so we take ldisc lock and reuse the setup
path at the end of tty_set_ldisc.
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Acked-by: Linus Torvalds <torvalds@linux-foundation.org>
Tested-by: Sebastian Andrzej Siewior <bigeasy@breakpoint.cc>
LKML-Reference: <20101031104136.GA511@Chamillionaire.breakpoint.cc>
LKML-Reference: <1287669539-22644-1-git-send-email-jslaby@suse.cz>
Cc: Alan Cox <alan@linux.intel.com>
Cc: stable@kernel.org [32, 33, 36]
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-11-01 06:17:51 +08:00
|
|
|
wake_up(&tty_ldisc_idle);
|
tty-ldisc: turn ldisc user count into a proper refcount
By using the user count for the actual lifetime rules, we can get rid of
the silly "wait_for_idle" logic, because any busy ldisc will
automatically stay around until the last user releases it. This avoids
a host of odd issues, and simplifies the code.
So now, when the last ldisc reference is dropped, we just release the
ldisc operations struct reference, and free the ldisc.
It looks obvious enough, and it does work for me, but the counting
_could_ be off. It probably isn't (bad counting in the new version would
generally imply that the old code did something really bad, like free an
ldisc with a non-zero count), but it does need some testing, and
preferably somebody looking at it.
With this change, both 'tty_ldisc_put()' and 'tty_ldisc_deref()' are
just aliases for the new ref-counting 'put_ldisc()'. Both of them
decrement the ldisc user count and free it if it goes down to zero.
They're identical functions, in other words.
But the reason they still exist as sepate functions is that one of them
was exported (tty_ldisc_deref) and had a stupid name (so I don't want to
use it as the main name), and the other one was used in multiple places
(and I didn't want to make the patch larger just to rename the users).
In addition to the refcounting, I did do some minimal cleanup. For
example, now "tty_ldisc_try()" actually returns the ldisc it got under
the lock, rather than returning true/false and then the caller would
look up the ldisc again (now without the protection of the lock).
That said, there's tons of dubious use of 'tty->ldisc' without obviously
proper locking or refcounting left. I expressly did _not_ want to try to
fix it all, keeping the patch minimal. There may or may not be bugs in
that kind of code, but they wouldn't be _new_ bugs.
That said, even if the bugs aren't new, the timing and lifetime will
change. For example, some silly code may depend on the 'tty->ldisc'
pointer not changing because they hold a refcount on the 'ldisc'. And
that's no longer true - if you hold a ref on the ldisc, the 'ldisc'
itself is safe, but tty->ldisc may change.
So the proper locking (remains) to hold tty->ldisc_mutex if you expect
tty->ldisc to be stable. That's not really a _new_ rule, but it's an
example of something that the old code might have unintentionally
depended on and hidden bugs.
Whatever. The patch _looks_ sensible to me. The only users of
ldisc->users are:
- get_ldisc() - atomically increment the count
- put_ldisc() - atomically decrements the count and releases if zero
- tty_ldisc_try_get() - creates the ldisc, and sets the count to 1.
The ldisc should then either be released, or be attached to a tty.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Tested-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Tested-by: Sergey Senozhatsky <sergey.senozhatsky@mail.by>
Acked-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2009-08-04 02:11:19 +08:00
|
|
|
}
|
|
|
|
|
|
2008-07-22 18:16:55 +08:00
|
|
|
/**
|
|
|
|
|
* tty_register_ldisc - install a line discipline
|
|
|
|
|
* @disc: ldisc number
|
|
|
|
|
* @new_ldisc: pointer to the ldisc object
|
|
|
|
|
*
|
|
|
|
|
* Installs a new line discipline into the kernel. The discipline
|
|
|
|
|
* is set up as unreferenced and then made available to the kernel
|
|
|
|
|
* from this point onwards.
|
|
|
|
|
*
|
|
|
|
|
* Locking:
|
|
|
|
|
* takes tty_ldisc_lock to guard against ldisc races
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
int tty_register_ldisc(int disc, struct tty_ldisc_ops *new_ldisc)
|
|
|
|
|
{
|
|
|
|
|
unsigned long flags;
|
|
|
|
|
int ret = 0;
|
|
|
|
|
|
|
|
|
|
if (disc < N_TTY || disc >= NR_LDISCS)
|
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
|
|
spin_lock_irqsave(&tty_ldisc_lock, flags);
|
|
|
|
|
tty_ldiscs[disc] = new_ldisc;
|
|
|
|
|
new_ldisc->num = disc;
|
|
|
|
|
new_ldisc->refcount = 0;
|
|
|
|
|
spin_unlock_irqrestore(&tty_ldisc_lock, flags);
|
|
|
|
|
|
|
|
|
|
return ret;
|
|
|
|
|
}
|
|
|
|
|
EXPORT_SYMBOL(tty_register_ldisc);
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* tty_unregister_ldisc - unload a line discipline
|
|
|
|
|
* @disc: ldisc number
|
|
|
|
|
* @new_ldisc: pointer to the ldisc object
|
|
|
|
|
*
|
|
|
|
|
* Remove a line discipline from the kernel providing it is not
|
|
|
|
|
* currently in use.
|
|
|
|
|
*
|
|
|
|
|
* Locking:
|
|
|
|
|
* takes tty_ldisc_lock to guard against ldisc races
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
int tty_unregister_ldisc(int disc)
|
|
|
|
|
{
|
|
|
|
|
unsigned long flags;
|
|
|
|
|
int ret = 0;
|
|
|
|
|
|
|
|
|
|
if (disc < N_TTY || disc >= NR_LDISCS)
|
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
|
|
spin_lock_irqsave(&tty_ldisc_lock, flags);
|
|
|
|
|
if (tty_ldiscs[disc]->refcount)
|
|
|
|
|
ret = -EBUSY;
|
|
|
|
|
else
|
|
|
|
|
tty_ldiscs[disc] = NULL;
|
|
|
|
|
spin_unlock_irqrestore(&tty_ldisc_lock, flags);
|
|
|
|
|
|
|
|
|
|
return ret;
|
|
|
|
|
}
|
|
|
|
|
EXPORT_SYMBOL(tty_unregister_ldisc);
|
|
|
|
|
|
2009-08-04 07:00:15 +08:00
|
|
|
static struct tty_ldisc_ops *get_ldops(int disc)
|
|
|
|
|
{
|
|
|
|
|
unsigned long flags;
|
|
|
|
|
struct tty_ldisc_ops *ldops, *ret;
|
|
|
|
|
|
|
|
|
|
spin_lock_irqsave(&tty_ldisc_lock, flags);
|
|
|
|
|
ret = ERR_PTR(-EINVAL);
|
|
|
|
|
ldops = tty_ldiscs[disc];
|
|
|
|
|
if (ldops) {
|
|
|
|
|
ret = ERR_PTR(-EAGAIN);
|
|
|
|
|
if (try_module_get(ldops->owner)) {
|
|
|
|
|
ldops->refcount++;
|
|
|
|
|
ret = ldops;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
spin_unlock_irqrestore(&tty_ldisc_lock, flags);
|
|
|
|
|
return ret;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void put_ldops(struct tty_ldisc_ops *ldops)
|
|
|
|
|
{
|
|
|
|
|
unsigned long flags;
|
|
|
|
|
|
|
|
|
|
spin_lock_irqsave(&tty_ldisc_lock, flags);
|
|
|
|
|
ldops->refcount--;
|
|
|
|
|
module_put(ldops->owner);
|
|
|
|
|
spin_unlock_irqrestore(&tty_ldisc_lock, flags);
|
|
|
|
|
}
|
2008-07-22 18:16:55 +08:00
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* tty_ldisc_get - take a reference to an ldisc
|
|
|
|
|
* @disc: ldisc number
|
|
|
|
|
*
|
|
|
|
|
* Takes a reference to a line discipline. Deals with refcounts and
|
|
|
|
|
* module locking counts. Returns NULL if the discipline is not available.
|
|
|
|
|
* Returns a pointer to the discipline and bumps the ref count if it is
|
|
|
|
|
* available
|
|
|
|
|
*
|
|
|
|
|
* Locking:
|
|
|
|
|
* takes tty_ldisc_lock to guard against ldisc races
|
|
|
|
|
*/
|
|
|
|
|
|
2009-06-11 19:50:12 +08:00
|
|
|
static struct tty_ldisc *tty_ldisc_get(int disc)
|
2008-07-22 18:16:55 +08:00
|
|
|
{
|
2009-06-11 19:50:12 +08:00
|
|
|
struct tty_ldisc *ld;
|
2009-08-04 07:01:28 +08:00
|
|
|
struct tty_ldisc_ops *ldops;
|
2008-07-22 18:16:55 +08:00
|
|
|
|
|
|
|
|
if (disc < N_TTY || disc >= NR_LDISCS)
|
2009-06-11 19:50:12 +08:00
|
|
|
return ERR_PTR(-EINVAL);
|
2009-08-04 07:01:28 +08:00
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* Get the ldisc ops - we may need to request them to be loaded
|
|
|
|
|
* dynamically and try again.
|
|
|
|
|
*/
|
|
|
|
|
ldops = get_ldops(disc);
|
|
|
|
|
if (IS_ERR(ldops)) {
|
2008-07-22 18:16:55 +08:00
|
|
|
request_module("tty-ldisc-%d", disc);
|
2009-08-04 07:01:28 +08:00
|
|
|
ldops = get_ldops(disc);
|
|
|
|
|
if (IS_ERR(ldops))
|
|
|
|
|
return ERR_CAST(ldops);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
ld = kmalloc(sizeof(struct tty_ldisc), GFP_KERNEL);
|
|
|
|
|
if (ld == NULL) {
|
|
|
|
|
put_ldops(ldops);
|
|
|
|
|
return ERR_PTR(-ENOMEM);
|
2008-07-22 18:16:55 +08:00
|
|
|
}
|
2009-08-04 07:01:28 +08:00
|
|
|
|
|
|
|
|
ld->ops = ldops;
|
|
|
|
|
atomic_set(&ld->users, 1);
|
2009-06-11 19:50:12 +08:00
|
|
|
return ld;
|
2008-07-22 18:16:55 +08:00
|
|
|
}
|
|
|
|
|
|
2009-06-11 19:51:41 +08:00
|
|
|
static void *tty_ldiscs_seq_start(struct seq_file *m, loff_t *pos)
|
2008-07-22 18:16:55 +08:00
|
|
|
{
|
|
|
|
|
return (*pos < NR_LDISCS) ? pos : NULL;
|
|
|
|
|
}
|
|
|
|
|
|
2009-06-11 19:51:41 +08:00
|
|
|
static void *tty_ldiscs_seq_next(struct seq_file *m, void *v, loff_t *pos)
|
2008-07-22 18:16:55 +08:00
|
|
|
{
|
|
|
|
|
(*pos)++;
|
|
|
|
|
return (*pos < NR_LDISCS) ? pos : NULL;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void tty_ldiscs_seq_stop(struct seq_file *m, void *v)
|
|
|
|
|
{
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int tty_ldiscs_seq_show(struct seq_file *m, void *v)
|
|
|
|
|
{
|
|
|
|
|
int i = *(loff_t *)v;
|
2009-08-04 07:00:15 +08:00
|
|
|
struct tty_ldisc_ops *ldops;
|
2009-06-11 19:51:41 +08:00
|
|
|
|
2009-08-04 07:00:15 +08:00
|
|
|
ldops = get_ldops(i);
|
|
|
|
|
if (IS_ERR(ldops))
|
2008-07-22 18:16:55 +08:00
|
|
|
return 0;
|
2009-08-04 07:00:15 +08:00
|
|
|
seq_printf(m, "%-10s %2d\n", ldops->name ? ldops->name : "???", i);
|
|
|
|
|
put_ldops(ldops);
|
2008-07-22 18:16:55 +08:00
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static const struct seq_operations tty_ldiscs_seq_ops = {
|
|
|
|
|
.start = tty_ldiscs_seq_start,
|
|
|
|
|
.next = tty_ldiscs_seq_next,
|
|
|
|
|
.stop = tty_ldiscs_seq_stop,
|
|
|
|
|
.show = tty_ldiscs_seq_show,
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
static int proc_tty_ldiscs_open(struct inode *inode, struct file *file)
|
|
|
|
|
{
|
|
|
|
|
return seq_open(file, &tty_ldiscs_seq_ops);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
const struct file_operations tty_ldiscs_proc_fops = {
|
|
|
|
|
.owner = THIS_MODULE,
|
|
|
|
|
.open = proc_tty_ldiscs_open,
|
|
|
|
|
.read = seq_read,
|
|
|
|
|
.llseek = seq_lseek,
|
|
|
|
|
.release = seq_release,
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* tty_ldisc_assign - set ldisc on a tty
|
|
|
|
|
* @tty: tty to assign
|
|
|
|
|
* @ld: line discipline
|
|
|
|
|
*
|
|
|
|
|
* Install an instance of a line discipline into a tty structure. The
|
2009-06-17 00:00:26 +08:00
|
|
|
* ldisc must have a reference count above zero to ensure it remains.
|
2008-07-22 18:16:55 +08:00
|
|
|
* The tty instance refcount starts at zero.
|
|
|
|
|
*
|
|
|
|
|
* Locking:
|
|
|
|
|
* Caller must hold references
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
static void tty_ldisc_assign(struct tty_struct *tty, struct tty_ldisc *ld)
|
|
|
|
|
{
|
2009-06-11 19:50:12 +08:00
|
|
|
tty->ldisc = ld;
|
2008-07-22 18:16:55 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* tty_ldisc_try - internal helper
|
|
|
|
|
* @tty: the tty
|
|
|
|
|
*
|
|
|
|
|
* Make a single attempt to grab and bump the refcount on
|
|
|
|
|
* the tty ldisc. Return 0 on failure or 1 on success. This is
|
|
|
|
|
* used to implement both the waiting and non waiting versions
|
|
|
|
|
* of tty_ldisc_ref
|
|
|
|
|
*
|
|
|
|
|
* Locking: takes tty_ldisc_lock
|
|
|
|
|
*/
|
|
|
|
|
|
tty-ldisc: turn ldisc user count into a proper refcount
By using the user count for the actual lifetime rules, we can get rid of
the silly "wait_for_idle" logic, because any busy ldisc will
automatically stay around until the last user releases it. This avoids
a host of odd issues, and simplifies the code.
So now, when the last ldisc reference is dropped, we just release the
ldisc operations struct reference, and free the ldisc.
It looks obvious enough, and it does work for me, but the counting
_could_ be off. It probably isn't (bad counting in the new version would
generally imply that the old code did something really bad, like free an
ldisc with a non-zero count), but it does need some testing, and
preferably somebody looking at it.
With this change, both 'tty_ldisc_put()' and 'tty_ldisc_deref()' are
just aliases for the new ref-counting 'put_ldisc()'. Both of them
decrement the ldisc user count and free it if it goes down to zero.
They're identical functions, in other words.
But the reason they still exist as sepate functions is that one of them
was exported (tty_ldisc_deref) and had a stupid name (so I don't want to
use it as the main name), and the other one was used in multiple places
(and I didn't want to make the patch larger just to rename the users).
In addition to the refcounting, I did do some minimal cleanup. For
example, now "tty_ldisc_try()" actually returns the ldisc it got under
the lock, rather than returning true/false and then the caller would
look up the ldisc again (now without the protection of the lock).
That said, there's tons of dubious use of 'tty->ldisc' without obviously
proper locking or refcounting left. I expressly did _not_ want to try to
fix it all, keeping the patch minimal. There may or may not be bugs in
that kind of code, but they wouldn't be _new_ bugs.
That said, even if the bugs aren't new, the timing and lifetime will
change. For example, some silly code may depend on the 'tty->ldisc'
pointer not changing because they hold a refcount on the 'ldisc'. And
that's no longer true - if you hold a ref on the ldisc, the 'ldisc'
itself is safe, but tty->ldisc may change.
So the proper locking (remains) to hold tty->ldisc_mutex if you expect
tty->ldisc to be stable. That's not really a _new_ rule, but it's an
example of something that the old code might have unintentionally
depended on and hidden bugs.
Whatever. The patch _looks_ sensible to me. The only users of
ldisc->users are:
- get_ldisc() - atomically increment the count
- put_ldisc() - atomically decrements the count and releases if zero
- tty_ldisc_try_get() - creates the ldisc, and sets the count to 1.
The ldisc should then either be released, or be attached to a tty.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Tested-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Tested-by: Sergey Senozhatsky <sergey.senozhatsky@mail.by>
Acked-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2009-08-04 02:11:19 +08:00
|
|
|
static struct tty_ldisc *tty_ldisc_try(struct tty_struct *tty)
|
2008-07-22 18:16:55 +08:00
|
|
|
{
|
|
|
|
|
unsigned long flags;
|
|
|
|
|
struct tty_ldisc *ld;
|
|
|
|
|
|
|
|
|
|
spin_lock_irqsave(&tty_ldisc_lock, flags);
|
tty-ldisc: turn ldisc user count into a proper refcount
By using the user count for the actual lifetime rules, we can get rid of
the silly "wait_for_idle" logic, because any busy ldisc will
automatically stay around until the last user releases it. This avoids
a host of odd issues, and simplifies the code.
So now, when the last ldisc reference is dropped, we just release the
ldisc operations struct reference, and free the ldisc.
It looks obvious enough, and it does work for me, but the counting
_could_ be off. It probably isn't (bad counting in the new version would
generally imply that the old code did something really bad, like free an
ldisc with a non-zero count), but it does need some testing, and
preferably somebody looking at it.
With this change, both 'tty_ldisc_put()' and 'tty_ldisc_deref()' are
just aliases for the new ref-counting 'put_ldisc()'. Both of them
decrement the ldisc user count and free it if it goes down to zero.
They're identical functions, in other words.
But the reason they still exist as sepate functions is that one of them
was exported (tty_ldisc_deref) and had a stupid name (so I don't want to
use it as the main name), and the other one was used in multiple places
(and I didn't want to make the patch larger just to rename the users).
In addition to the refcounting, I did do some minimal cleanup. For
example, now "tty_ldisc_try()" actually returns the ldisc it got under
the lock, rather than returning true/false and then the caller would
look up the ldisc again (now without the protection of the lock).
That said, there's tons of dubious use of 'tty->ldisc' without obviously
proper locking or refcounting left. I expressly did _not_ want to try to
fix it all, keeping the patch minimal. There may or may not be bugs in
that kind of code, but they wouldn't be _new_ bugs.
That said, even if the bugs aren't new, the timing and lifetime will
change. For example, some silly code may depend on the 'tty->ldisc'
pointer not changing because they hold a refcount on the 'ldisc'. And
that's no longer true - if you hold a ref on the ldisc, the 'ldisc'
itself is safe, but tty->ldisc may change.
So the proper locking (remains) to hold tty->ldisc_mutex if you expect
tty->ldisc to be stable. That's not really a _new_ rule, but it's an
example of something that the old code might have unintentionally
depended on and hidden bugs.
Whatever. The patch _looks_ sensible to me. The only users of
ldisc->users are:
- get_ldisc() - atomically increment the count
- put_ldisc() - atomically decrements the count and releases if zero
- tty_ldisc_try_get() - creates the ldisc, and sets the count to 1.
The ldisc should then either be released, or be attached to a tty.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Tested-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Tested-by: Sergey Senozhatsky <sergey.senozhatsky@mail.by>
Acked-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2009-08-04 02:11:19 +08:00
|
|
|
ld = NULL;
|
|
|
|
|
if (test_bit(TTY_LDISC, &tty->flags))
|
|
|
|
|
ld = get_ldisc(tty->ldisc);
|
2008-07-22 18:16:55 +08:00
|
|
|
spin_unlock_irqrestore(&tty_ldisc_lock, flags);
|
tty-ldisc: turn ldisc user count into a proper refcount
By using the user count for the actual lifetime rules, we can get rid of
the silly "wait_for_idle" logic, because any busy ldisc will
automatically stay around until the last user releases it. This avoids
a host of odd issues, and simplifies the code.
So now, when the last ldisc reference is dropped, we just release the
ldisc operations struct reference, and free the ldisc.
It looks obvious enough, and it does work for me, but the counting
_could_ be off. It probably isn't (bad counting in the new version would
generally imply that the old code did something really bad, like free an
ldisc with a non-zero count), but it does need some testing, and
preferably somebody looking at it.
With this change, both 'tty_ldisc_put()' and 'tty_ldisc_deref()' are
just aliases for the new ref-counting 'put_ldisc()'. Both of them
decrement the ldisc user count and free it if it goes down to zero.
They're identical functions, in other words.
But the reason they still exist as sepate functions is that one of them
was exported (tty_ldisc_deref) and had a stupid name (so I don't want to
use it as the main name), and the other one was used in multiple places
(and I didn't want to make the patch larger just to rename the users).
In addition to the refcounting, I did do some minimal cleanup. For
example, now "tty_ldisc_try()" actually returns the ldisc it got under
the lock, rather than returning true/false and then the caller would
look up the ldisc again (now without the protection of the lock).
That said, there's tons of dubious use of 'tty->ldisc' without obviously
proper locking or refcounting left. I expressly did _not_ want to try to
fix it all, keeping the patch minimal. There may or may not be bugs in
that kind of code, but they wouldn't be _new_ bugs.
That said, even if the bugs aren't new, the timing and lifetime will
change. For example, some silly code may depend on the 'tty->ldisc'
pointer not changing because they hold a refcount on the 'ldisc'. And
that's no longer true - if you hold a ref on the ldisc, the 'ldisc'
itself is safe, but tty->ldisc may change.
So the proper locking (remains) to hold tty->ldisc_mutex if you expect
tty->ldisc to be stable. That's not really a _new_ rule, but it's an
example of something that the old code might have unintentionally
depended on and hidden bugs.
Whatever. The patch _looks_ sensible to me. The only users of
ldisc->users are:
- get_ldisc() - atomically increment the count
- put_ldisc() - atomically decrements the count and releases if zero
- tty_ldisc_try_get() - creates the ldisc, and sets the count to 1.
The ldisc should then either be released, or be attached to a tty.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Tested-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Tested-by: Sergey Senozhatsky <sergey.senozhatsky@mail.by>
Acked-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2009-08-04 02:11:19 +08:00
|
|
|
return ld;
|
2008-07-22 18:16:55 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* tty_ldisc_ref_wait - wait for the tty ldisc
|
|
|
|
|
* @tty: tty device
|
|
|
|
|
*
|
|
|
|
|
* Dereference the line discipline for the terminal and take a
|
|
|
|
|
* reference to it. If the line discipline is in flux then
|
|
|
|
|
* wait patiently until it changes.
|
|
|
|
|
*
|
|
|
|
|
* Note: Must not be called from an IRQ/timer context. The caller
|
|
|
|
|
* must also be careful not to hold other locks that will deadlock
|
|
|
|
|
* against a discipline change, such as an existing ldisc reference
|
|
|
|
|
* (which we check for)
|
|
|
|
|
*
|
|
|
|
|
* Locking: call functions take tty_ldisc_lock
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
struct tty_ldisc *tty_ldisc_ref_wait(struct tty_struct *tty)
|
|
|
|
|
{
|
tty-ldisc: turn ldisc user count into a proper refcount
By using the user count for the actual lifetime rules, we can get rid of
the silly "wait_for_idle" logic, because any busy ldisc will
automatically stay around until the last user releases it. This avoids
a host of odd issues, and simplifies the code.
So now, when the last ldisc reference is dropped, we just release the
ldisc operations struct reference, and free the ldisc.
It looks obvious enough, and it does work for me, but the counting
_could_ be off. It probably isn't (bad counting in the new version would
generally imply that the old code did something really bad, like free an
ldisc with a non-zero count), but it does need some testing, and
preferably somebody looking at it.
With this change, both 'tty_ldisc_put()' and 'tty_ldisc_deref()' are
just aliases for the new ref-counting 'put_ldisc()'. Both of them
decrement the ldisc user count and free it if it goes down to zero.
They're identical functions, in other words.
But the reason they still exist as sepate functions is that one of them
was exported (tty_ldisc_deref) and had a stupid name (so I don't want to
use it as the main name), and the other one was used in multiple places
(and I didn't want to make the patch larger just to rename the users).
In addition to the refcounting, I did do some minimal cleanup. For
example, now "tty_ldisc_try()" actually returns the ldisc it got under
the lock, rather than returning true/false and then the caller would
look up the ldisc again (now without the protection of the lock).
That said, there's tons of dubious use of 'tty->ldisc' without obviously
proper locking or refcounting left. I expressly did _not_ want to try to
fix it all, keeping the patch minimal. There may or may not be bugs in
that kind of code, but they wouldn't be _new_ bugs.
That said, even if the bugs aren't new, the timing and lifetime will
change. For example, some silly code may depend on the 'tty->ldisc'
pointer not changing because they hold a refcount on the 'ldisc'. And
that's no longer true - if you hold a ref on the ldisc, the 'ldisc'
itself is safe, but tty->ldisc may change.
So the proper locking (remains) to hold tty->ldisc_mutex if you expect
tty->ldisc to be stable. That's not really a _new_ rule, but it's an
example of something that the old code might have unintentionally
depended on and hidden bugs.
Whatever. The patch _looks_ sensible to me. The only users of
ldisc->users are:
- get_ldisc() - atomically increment the count
- put_ldisc() - atomically decrements the count and releases if zero
- tty_ldisc_try_get() - creates the ldisc, and sets the count to 1.
The ldisc should then either be released, or be attached to a tty.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Tested-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Tested-by: Sergey Senozhatsky <sergey.senozhatsky@mail.by>
Acked-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2009-08-04 02:11:19 +08:00
|
|
|
struct tty_ldisc *ld;
|
|
|
|
|
|
2008-07-22 18:16:55 +08:00
|
|
|
/* wait_event is a macro */
|
tty-ldisc: turn ldisc user count into a proper refcount
By using the user count for the actual lifetime rules, we can get rid of
the silly "wait_for_idle" logic, because any busy ldisc will
automatically stay around until the last user releases it. This avoids
a host of odd issues, and simplifies the code.
So now, when the last ldisc reference is dropped, we just release the
ldisc operations struct reference, and free the ldisc.
It looks obvious enough, and it does work for me, but the counting
_could_ be off. It probably isn't (bad counting in the new version would
generally imply that the old code did something really bad, like free an
ldisc with a non-zero count), but it does need some testing, and
preferably somebody looking at it.
With this change, both 'tty_ldisc_put()' and 'tty_ldisc_deref()' are
just aliases for the new ref-counting 'put_ldisc()'. Both of them
decrement the ldisc user count and free it if it goes down to zero.
They're identical functions, in other words.
But the reason they still exist as sepate functions is that one of them
was exported (tty_ldisc_deref) and had a stupid name (so I don't want to
use it as the main name), and the other one was used in multiple places
(and I didn't want to make the patch larger just to rename the users).
In addition to the refcounting, I did do some minimal cleanup. For
example, now "tty_ldisc_try()" actually returns the ldisc it got under
the lock, rather than returning true/false and then the caller would
look up the ldisc again (now without the protection of the lock).
That said, there's tons of dubious use of 'tty->ldisc' without obviously
proper locking or refcounting left. I expressly did _not_ want to try to
fix it all, keeping the patch minimal. There may or may not be bugs in
that kind of code, but they wouldn't be _new_ bugs.
That said, even if the bugs aren't new, the timing and lifetime will
change. For example, some silly code may depend on the 'tty->ldisc'
pointer not changing because they hold a refcount on the 'ldisc'. And
that's no longer true - if you hold a ref on the ldisc, the 'ldisc'
itself is safe, but tty->ldisc may change.
So the proper locking (remains) to hold tty->ldisc_mutex if you expect
tty->ldisc to be stable. That's not really a _new_ rule, but it's an
example of something that the old code might have unintentionally
depended on and hidden bugs.
Whatever. The patch _looks_ sensible to me. The only users of
ldisc->users are:
- get_ldisc() - atomically increment the count
- put_ldisc() - atomically decrements the count and releases if zero
- tty_ldisc_try_get() - creates the ldisc, and sets the count to 1.
The ldisc should then either be released, or be attached to a tty.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Tested-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Tested-by: Sergey Senozhatsky <sergey.senozhatsky@mail.by>
Acked-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2009-08-04 02:11:19 +08:00
|
|
|
wait_event(tty_ldisc_wait, (ld = tty_ldisc_try(tty)) != NULL);
|
|
|
|
|
return ld;
|
2008-07-22 18:16:55 +08:00
|
|
|
}
|
|
|
|
|
EXPORT_SYMBOL_GPL(tty_ldisc_ref_wait);
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* tty_ldisc_ref - get the tty ldisc
|
|
|
|
|
* @tty: tty device
|
|
|
|
|
*
|
|
|
|
|
* Dereference the line discipline for the terminal and take a
|
|
|
|
|
* reference to it. If the line discipline is in flux then
|
|
|
|
|
* return NULL. Can be called from IRQ and timer functions.
|
|
|
|
|
*
|
|
|
|
|
* Locking: called functions take tty_ldisc_lock
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
struct tty_ldisc *tty_ldisc_ref(struct tty_struct *tty)
|
|
|
|
|
{
|
tty-ldisc: turn ldisc user count into a proper refcount
By using the user count for the actual lifetime rules, we can get rid of
the silly "wait_for_idle" logic, because any busy ldisc will
automatically stay around until the last user releases it. This avoids
a host of odd issues, and simplifies the code.
So now, when the last ldisc reference is dropped, we just release the
ldisc operations struct reference, and free the ldisc.
It looks obvious enough, and it does work for me, but the counting
_could_ be off. It probably isn't (bad counting in the new version would
generally imply that the old code did something really bad, like free an
ldisc with a non-zero count), but it does need some testing, and
preferably somebody looking at it.
With this change, both 'tty_ldisc_put()' and 'tty_ldisc_deref()' are
just aliases for the new ref-counting 'put_ldisc()'. Both of them
decrement the ldisc user count and free it if it goes down to zero.
They're identical functions, in other words.
But the reason they still exist as sepate functions is that one of them
was exported (tty_ldisc_deref) and had a stupid name (so I don't want to
use it as the main name), and the other one was used in multiple places
(and I didn't want to make the patch larger just to rename the users).
In addition to the refcounting, I did do some minimal cleanup. For
example, now "tty_ldisc_try()" actually returns the ldisc it got under
the lock, rather than returning true/false and then the caller would
look up the ldisc again (now without the protection of the lock).
That said, there's tons of dubious use of 'tty->ldisc' without obviously
proper locking or refcounting left. I expressly did _not_ want to try to
fix it all, keeping the patch minimal. There may or may not be bugs in
that kind of code, but they wouldn't be _new_ bugs.
That said, even if the bugs aren't new, the timing and lifetime will
change. For example, some silly code may depend on the 'tty->ldisc'
pointer not changing because they hold a refcount on the 'ldisc'. And
that's no longer true - if you hold a ref on the ldisc, the 'ldisc'
itself is safe, but tty->ldisc may change.
So the proper locking (remains) to hold tty->ldisc_mutex if you expect
tty->ldisc to be stable. That's not really a _new_ rule, but it's an
example of something that the old code might have unintentionally
depended on and hidden bugs.
Whatever. The patch _looks_ sensible to me. The only users of
ldisc->users are:
- get_ldisc() - atomically increment the count
- put_ldisc() - atomically decrements the count and releases if zero
- tty_ldisc_try_get() - creates the ldisc, and sets the count to 1.
The ldisc should then either be released, or be attached to a tty.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Tested-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Tested-by: Sergey Senozhatsky <sergey.senozhatsky@mail.by>
Acked-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2009-08-04 02:11:19 +08:00
|
|
|
return tty_ldisc_try(tty);
|
2008-07-22 18:16:55 +08:00
|
|
|
}
|
|
|
|
|
EXPORT_SYMBOL_GPL(tty_ldisc_ref);
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* tty_ldisc_deref - free a tty ldisc reference
|
|
|
|
|
* @ld: reference to free up
|
|
|
|
|
*
|
|
|
|
|
* Undoes the effect of tty_ldisc_ref or tty_ldisc_ref_wait. May
|
|
|
|
|
* be called in IRQ context.
|
|
|
|
|
*
|
|
|
|
|
* Locking: takes tty_ldisc_lock
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
void tty_ldisc_deref(struct tty_ldisc *ld)
|
|
|
|
|
{
|
tty-ldisc: turn ldisc user count into a proper refcount
By using the user count for the actual lifetime rules, we can get rid of
the silly "wait_for_idle" logic, because any busy ldisc will
automatically stay around until the last user releases it. This avoids
a host of odd issues, and simplifies the code.
So now, when the last ldisc reference is dropped, we just release the
ldisc operations struct reference, and free the ldisc.
It looks obvious enough, and it does work for me, but the counting
_could_ be off. It probably isn't (bad counting in the new version would
generally imply that the old code did something really bad, like free an
ldisc with a non-zero count), but it does need some testing, and
preferably somebody looking at it.
With this change, both 'tty_ldisc_put()' and 'tty_ldisc_deref()' are
just aliases for the new ref-counting 'put_ldisc()'. Both of them
decrement the ldisc user count and free it if it goes down to zero.
They're identical functions, in other words.
But the reason they still exist as sepate functions is that one of them
was exported (tty_ldisc_deref) and had a stupid name (so I don't want to
use it as the main name), and the other one was used in multiple places
(and I didn't want to make the patch larger just to rename the users).
In addition to the refcounting, I did do some minimal cleanup. For
example, now "tty_ldisc_try()" actually returns the ldisc it got under
the lock, rather than returning true/false and then the caller would
look up the ldisc again (now without the protection of the lock).
That said, there's tons of dubious use of 'tty->ldisc' without obviously
proper locking or refcounting left. I expressly did _not_ want to try to
fix it all, keeping the patch minimal. There may or may not be bugs in
that kind of code, but they wouldn't be _new_ bugs.
That said, even if the bugs aren't new, the timing and lifetime will
change. For example, some silly code may depend on the 'tty->ldisc'
pointer not changing because they hold a refcount on the 'ldisc'. And
that's no longer true - if you hold a ref on the ldisc, the 'ldisc'
itself is safe, but tty->ldisc may change.
So the proper locking (remains) to hold tty->ldisc_mutex if you expect
tty->ldisc to be stable. That's not really a _new_ rule, but it's an
example of something that the old code might have unintentionally
depended on and hidden bugs.
Whatever. The patch _looks_ sensible to me. The only users of
ldisc->users are:
- get_ldisc() - atomically increment the count
- put_ldisc() - atomically decrements the count and releases if zero
- tty_ldisc_try_get() - creates the ldisc, and sets the count to 1.
The ldisc should then either be released, or be attached to a tty.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Tested-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Tested-by: Sergey Senozhatsky <sergey.senozhatsky@mail.by>
Acked-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2009-08-04 02:11:19 +08:00
|
|
|
put_ldisc(ld);
|
2008-07-22 18:16:55 +08:00
|
|
|
}
|
|
|
|
|
EXPORT_SYMBOL_GPL(tty_ldisc_deref);
|
|
|
|
|
|
tty-ldisc: turn ldisc user count into a proper refcount
By using the user count for the actual lifetime rules, we can get rid of
the silly "wait_for_idle" logic, because any busy ldisc will
automatically stay around until the last user releases it. This avoids
a host of odd issues, and simplifies the code.
So now, when the last ldisc reference is dropped, we just release the
ldisc operations struct reference, and free the ldisc.
It looks obvious enough, and it does work for me, but the counting
_could_ be off. It probably isn't (bad counting in the new version would
generally imply that the old code did something really bad, like free an
ldisc with a non-zero count), but it does need some testing, and
preferably somebody looking at it.
With this change, both 'tty_ldisc_put()' and 'tty_ldisc_deref()' are
just aliases for the new ref-counting 'put_ldisc()'. Both of them
decrement the ldisc user count and free it if it goes down to zero.
They're identical functions, in other words.
But the reason they still exist as sepate functions is that one of them
was exported (tty_ldisc_deref) and had a stupid name (so I don't want to
use it as the main name), and the other one was used in multiple places
(and I didn't want to make the patch larger just to rename the users).
In addition to the refcounting, I did do some minimal cleanup. For
example, now "tty_ldisc_try()" actually returns the ldisc it got under
the lock, rather than returning true/false and then the caller would
look up the ldisc again (now without the protection of the lock).
That said, there's tons of dubious use of 'tty->ldisc' without obviously
proper locking or refcounting left. I expressly did _not_ want to try to
fix it all, keeping the patch minimal. There may or may not be bugs in
that kind of code, but they wouldn't be _new_ bugs.
That said, even if the bugs aren't new, the timing and lifetime will
change. For example, some silly code may depend on the 'tty->ldisc'
pointer not changing because they hold a refcount on the 'ldisc'. And
that's no longer true - if you hold a ref on the ldisc, the 'ldisc'
itself is safe, but tty->ldisc may change.
So the proper locking (remains) to hold tty->ldisc_mutex if you expect
tty->ldisc to be stable. That's not really a _new_ rule, but it's an
example of something that the old code might have unintentionally
depended on and hidden bugs.
Whatever. The patch _looks_ sensible to me. The only users of
ldisc->users are:
- get_ldisc() - atomically increment the count
- put_ldisc() - atomically decrements the count and releases if zero
- tty_ldisc_try_get() - creates the ldisc, and sets the count to 1.
The ldisc should then either be released, or be attached to a tty.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Tested-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Tested-by: Sergey Senozhatsky <sergey.senozhatsky@mail.by>
Acked-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2009-08-04 02:11:19 +08:00
|
|
|
static inline void tty_ldisc_put(struct tty_ldisc *ld)
|
|
|
|
|
{
|
|
|
|
|
put_ldisc(ld);
|
|
|
|
|
}
|
|
|
|
|
|
2008-07-22 18:16:55 +08:00
|
|
|
/**
|
|
|
|
|
* tty_ldisc_enable - allow ldisc use
|
|
|
|
|
* @tty: terminal to activate ldisc on
|
|
|
|
|
*
|
|
|
|
|
* Set the TTY_LDISC flag when the line discipline can be called
|
2009-01-02 21:44:56 +08:00
|
|
|
* again. Do necessary wakeups for existing sleepers. Clear the LDISC
|
|
|
|
|
* changing flag to indicate any ldisc change is now over.
|
2008-07-22 18:16:55 +08:00
|
|
|
*
|
2009-01-02 21:44:56 +08:00
|
|
|
* Note: nobody should set the TTY_LDISC bit except via this function.
|
|
|
|
|
* Clearing directly is allowed.
|
2008-07-22 18:16:55 +08:00
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
void tty_ldisc_enable(struct tty_struct *tty)
|
|
|
|
|
{
|
|
|
|
|
set_bit(TTY_LDISC, &tty->flags);
|
2009-01-02 21:44:56 +08:00
|
|
|
clear_bit(TTY_LDISC_CHANGING, &tty->flags);
|
2008-07-22 18:16:55 +08:00
|
|
|
wake_up(&tty_ldisc_wait);
|
|
|
|
|
}
|
|
|
|
|
|
2009-06-11 19:50:58 +08:00
|
|
|
/**
|
|
|
|
|
* tty_ldisc_flush - flush line discipline queue
|
|
|
|
|
* @tty: tty
|
|
|
|
|
*
|
|
|
|
|
* Flush the line discipline queue (if any) for this tty. If there
|
|
|
|
|
* is no line discipline active this is a no-op.
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
void tty_ldisc_flush(struct tty_struct *tty)
|
|
|
|
|
{
|
|
|
|
|
struct tty_ldisc *ld = tty_ldisc_ref(tty);
|
|
|
|
|
if (ld) {
|
|
|
|
|
if (ld->ops->flush_buffer)
|
|
|
|
|
ld->ops->flush_buffer(tty);
|
|
|
|
|
tty_ldisc_deref(ld);
|
|
|
|
|
}
|
|
|
|
|
tty_buffer_flush(tty);
|
|
|
|
|
}
|
|
|
|
|
EXPORT_SYMBOL_GPL(tty_ldisc_flush);
|
|
|
|
|
|
2008-07-22 18:16:55 +08:00
|
|
|
/**
|
|
|
|
|
* tty_set_termios_ldisc - set ldisc field
|
|
|
|
|
* @tty: tty structure
|
|
|
|
|
* @num: line discipline number
|
|
|
|
|
*
|
|
|
|
|
* This is probably overkill for real world processors but
|
|
|
|
|
* they are not on hot paths so a little discipline won't do
|
|
|
|
|
* any harm.
|
|
|
|
|
*
|
|
|
|
|
* Locking: takes termios_mutex
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
static void tty_set_termios_ldisc(struct tty_struct *tty, int num)
|
|
|
|
|
{
|
|
|
|
|
mutex_lock(&tty->termios_mutex);
|
|
|
|
|
tty->termios->c_line = num;
|
|
|
|
|
mutex_unlock(&tty->termios_mutex);
|
|
|
|
|
}
|
|
|
|
|
|
2009-06-11 19:50:12 +08:00
|
|
|
/**
|
|
|
|
|
* tty_ldisc_open - open a line discipline
|
|
|
|
|
* @tty: tty we are opening the ldisc on
|
|
|
|
|
* @ld: discipline to open
|
|
|
|
|
*
|
|
|
|
|
* A helper opening method. Also a convenient debugging and check
|
|
|
|
|
* point.
|
2010-06-02 04:53:01 +08:00
|
|
|
*
|
|
|
|
|
* Locking: always called with BTM already held.
|
2009-06-11 19:50:12 +08:00
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
static int tty_ldisc_open(struct tty_struct *tty, struct tty_ldisc *ld)
|
|
|
|
|
{
|
|
|
|
|
WARN_ON(test_and_set_bit(TTY_LDISC_OPEN, &tty->flags));
|
2009-11-30 21:18:35 +08:00
|
|
|
if (ld->ops->open) {
|
|
|
|
|
int ret;
|
2010-06-02 04:53:01 +08:00
|
|
|
/* BTM here locks versus a hangup event */
|
2009-11-30 21:18:35 +08:00
|
|
|
ret = ld->ops->open(tty);
|
2010-11-25 07:27:54 +08:00
|
|
|
if (ret)
|
|
|
|
|
clear_bit(TTY_LDISC_OPEN, &tty->flags);
|
2009-11-30 21:18:35 +08:00
|
|
|
return ret;
|
|
|
|
|
}
|
2009-06-11 19:50:12 +08:00
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* tty_ldisc_close - close a line discipline
|
|
|
|
|
* @tty: tty we are opening the ldisc on
|
|
|
|
|
* @ld: discipline to close
|
|
|
|
|
*
|
|
|
|
|
* A helper close method. Also a convenient debugging and check
|
|
|
|
|
* point.
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
static void tty_ldisc_close(struct tty_struct *tty, struct tty_ldisc *ld)
|
|
|
|
|
{
|
|
|
|
|
WARN_ON(!test_bit(TTY_LDISC_OPEN, &tty->flags));
|
|
|
|
|
clear_bit(TTY_LDISC_OPEN, &tty->flags);
|
|
|
|
|
if (ld->ops->close)
|
|
|
|
|
ld->ops->close(tty);
|
|
|
|
|
}
|
2008-07-22 18:16:55 +08:00
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* tty_ldisc_restore - helper for tty ldisc change
|
|
|
|
|
* @tty: tty to recover
|
|
|
|
|
* @old: previous ldisc
|
|
|
|
|
*
|
|
|
|
|
* Restore the previous line discipline or N_TTY when a line discipline
|
|
|
|
|
* change fails due to an open error
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
static void tty_ldisc_restore(struct tty_struct *tty, struct tty_ldisc *old)
|
|
|
|
|
{
|
|
|
|
|
char buf[64];
|
2009-06-11 19:50:12 +08:00
|
|
|
struct tty_ldisc *new_ldisc;
|
|
|
|
|
int r;
|
2008-07-22 18:16:55 +08:00
|
|
|
|
|
|
|
|
/* There is an outstanding reference here so this is safe */
|
2009-06-11 19:50:12 +08:00
|
|
|
old = tty_ldisc_get(old->ops->num);
|
|
|
|
|
WARN_ON(IS_ERR(old));
|
2008-07-22 18:16:55 +08:00
|
|
|
tty_ldisc_assign(tty, old);
|
|
|
|
|
tty_set_termios_ldisc(tty, old->ops->num);
|
2009-06-11 19:50:12 +08:00
|
|
|
if (tty_ldisc_open(tty, old) < 0) {
|
|
|
|
|
tty_ldisc_put(old);
|
2008-07-22 18:16:55 +08:00
|
|
|
/* This driver is always present */
|
2009-06-11 19:51:41 +08:00
|
|
|
new_ldisc = tty_ldisc_get(N_TTY);
|
2009-06-11 19:50:12 +08:00
|
|
|
if (IS_ERR(new_ldisc))
|
2008-07-22 18:16:55 +08:00
|
|
|
panic("n_tty: get");
|
2009-06-11 19:50:12 +08:00
|
|
|
tty_ldisc_assign(tty, new_ldisc);
|
2008-07-22 18:16:55 +08:00
|
|
|
tty_set_termios_ldisc(tty, N_TTY);
|
2009-06-11 19:50:12 +08:00
|
|
|
r = tty_ldisc_open(tty, new_ldisc);
|
|
|
|
|
if (r < 0)
|
|
|
|
|
panic("Couldn't open N_TTY ldisc for "
|
|
|
|
|
"%s --- error %d.",
|
|
|
|
|
tty_name(tty, buf), r);
|
2008-07-22 18:16:55 +08:00
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
2009-06-11 19:48:02 +08:00
|
|
|
/**
|
2009-06-11 19:50:12 +08:00
|
|
|
* tty_ldisc_halt - shut down the line discipline
|
2009-06-11 19:48:02 +08:00
|
|
|
* @tty: tty device
|
|
|
|
|
*
|
|
|
|
|
* Shut down the line discipline and work queue for this tty device.
|
|
|
|
|
* The TTY_LDISC flag being cleared ensures no further references can
|
|
|
|
|
* be obtained while the delayed work queue halt ensures that no more
|
|
|
|
|
* data is fed to the ldisc.
|
|
|
|
|
*
|
tty: make sure to flush any pending work when halting the ldisc
When I rewrote tty ldisc code to use proper reference counts (commits
65b770468e98 and cbe9352fa08f) in order to avoid a race with hangup, the
test-program that Eric Biederman used to trigger the original problem
seems to have exposed another long-standing bug: the hangup code did the
'tty_ldisc_halt()' to stop any buffer flushing activity, but unlike the
other call sites it never actually flushed any pending work.
As a result, if you get just the right timing, the pending work may be
just about to execute (ie the timer has already triggered and thus
cancel_delayed_work() was a no-op), when we then re-initialize the ldisc
from under it.
That, in turn, results in various random problems, usually seen as a
NULL pointer dereference in run_timer_softirq() or a BUG() in
worker_thread (but it can be almost anything).
Fix it by adding the required 'flush_scheduled_work()' after doing the
tty_ldisc_halt() (this also requires us to move the ldisc halt to before
taking the ldisc mutex in order to avoid a deadlock with the workqueue
executing do_tty_hangup, which requires the mutex).
The locking should be cleaned up one day (the requirement to do this
outside the ldisc_mutex is very annoying, and weakens the lock), but
that's a larger and separate undertaking.
Reported-by: Eric W. Biederman <ebiederm@xmission.com>
Tested-by: Xiaotian Feng <xtfeng@gmail.com>
Tested-by: Yanmin Zhang <yanmin_zhang@linux.intel.com>
Tested-by: Dave Young <hidave.darkstar@gmail.com>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Greg Kroah-Hartman <gregkh@suse.de>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-08-26 00:12:43 +08:00
|
|
|
* You need to do a 'flush_scheduled_work()' (outside the ldisc_mutex)
|
|
|
|
|
* in order to make sure any currently executing ldisc work is also
|
|
|
|
|
* flushed.
|
2009-06-11 19:48:02 +08:00
|
|
|
*/
|
|
|
|
|
|
2009-06-11 19:50:12 +08:00
|
|
|
static int tty_ldisc_halt(struct tty_struct *tty)
|
2009-06-11 19:48:02 +08:00
|
|
|
{
|
|
|
|
|
clear_bit(TTY_LDISC, &tty->flags);
|
2011-03-23 07:17:32 +08:00
|
|
|
return cancel_work_sync(&tty->buf.work);
|
2009-06-11 19:48:02 +08:00
|
|
|
}
|
|
|
|
|
|
2011-01-25 00:54:12 +08:00
|
|
|
/**
|
|
|
|
|
* tty_ldisc_flush_works - flush all works of a tty
|
|
|
|
|
* @tty: tty device to flush works for
|
|
|
|
|
*
|
|
|
|
|
* Sync flush all works belonging to @tty.
|
|
|
|
|
*/
|
|
|
|
|
static void tty_ldisc_flush_works(struct tty_struct *tty)
|
|
|
|
|
{
|
|
|
|
|
flush_work_sync(&tty->hangup_work);
|
|
|
|
|
flush_work_sync(&tty->SAK_work);
|
2011-03-23 07:17:32 +08:00
|
|
|
flush_work_sync(&tty->buf.work);
|
2011-01-25 00:54:12 +08:00
|
|
|
}
|
|
|
|
|
|
TTY: restore tty_ldisc_wait_idle
It was removed in 65b770468e98 (tty-ldisc: turn ldisc user count into
a proper refcount), but we need to wait for last user to quit the
ldisc before we close it in tty_set_ldisc.
Otherwise weird things start to happen. There might be processes
waiting in tty_read->n_tty_read on tty->read_wait for input to appear
and at that moment, a change of ldisc is fatal. n_tty_close is called,
it frees read_buf and the waiting process is still in the middle of
reading and goes nuts after it is woken.
Previously we prevented close to happen when others are in ldisc ops
by tty_ldisc_wait_idle in tty_set_ldisc. But the commit above removed
that. So revoke the change and test whether there is 1 user (=we), and
allow the close then.
We can do that without ldisc/tty locks, because nobody else can open
the device due to TTY_LDISC_CHANGING bit set, so we in fact wait for
everybody to leave.
I don't understand why tty_ldisc_lock would be needed either when the
counter is an atomic variable, so this is a lockless
tty_ldisc_wait_idle.
On the other hand, if we fail to wait (timeout or signal), we have to
reenable the halted ldiscs, so we take ldisc lock and reuse the setup
path at the end of tty_set_ldisc.
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Acked-by: Linus Torvalds <torvalds@linux-foundation.org>
Tested-by: Sebastian Andrzej Siewior <bigeasy@breakpoint.cc>
LKML-Reference: <20101031104136.GA511@Chamillionaire.breakpoint.cc>
LKML-Reference: <1287669539-22644-1-git-send-email-jslaby@suse.cz>
Cc: Alan Cox <alan@linux.intel.com>
Cc: stable@kernel.org [32, 33, 36]
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-11-01 06:17:51 +08:00
|
|
|
/**
|
|
|
|
|
* tty_ldisc_wait_idle - wait for the ldisc to become idle
|
|
|
|
|
* @tty: tty to wait for
|
|
|
|
|
*
|
|
|
|
|
* Wait for the line discipline to become idle. The discipline must
|
|
|
|
|
* have been halted for this to guarantee it remains idle.
|
|
|
|
|
*/
|
|
|
|
|
static int tty_ldisc_wait_idle(struct tty_struct *tty)
|
|
|
|
|
{
|
|
|
|
|
int ret;
|
TTY: ldisc, do not close until there are readers
We restored tty_ldisc_wait_idle in 100eeae2c5c (TTY: restore
tty_ldisc_wait_idle). We used it in the ldisc changing path to fix the
case where there are tasks in n_tty_read waiting for data and somebody
tries to change ldisc.
Similar to the case above, there may be also tasks waiting in
n_tty_read while hangup is performed. As 65b770468e98 (tty-ldisc: turn
ldisc user count into a proper refcount) removed the wait-until-idle
from all paths, hangup path won't wait for them to disappear either
now. So add it back even to the hangup path.
There is a difference, we need uninterruptible sleep as there is
obviously HUP signal pending. So tty_ldisc_wait_idle now sleeps
without possibility to be interrupted. This is what original
tty_ldisc_wait_idle did. After the wait idle reintroduction
(100eeae2c5c), we have had interruptible sleeps for the ldisc changing
path. But as there is a 5s timeout anyway, we don't allow it to be
interrupted from now on. It's not worth the added complexity of
deciding what kind of sleep we want.
Before 65b770468e98 tty_ldisc_release was called also from
tty_ldisc_release. It is called from tty_release, so I don't think we
need to restore that one.
This is nicely reproducible after constifying the timing when
drivers/tty/n_tty.c is patched as follows ("TTY: ntty, add one more
sanity check" patch is needed to actually see it explode):
%% -1548,6 +1549,7 @@ static int n_tty_open(struct tty_struct *tty)
/* These are ugly. Currently a malloc failure here can panic */
if (!tty->read_buf) {
+ msleep(100);
tty->read_buf = kzalloc(N_TTY_BUF_SIZE, GFP_KERNEL);
if (!tty->read_buf)
return -ENOMEM;
%% -1785,6 +1788,7 @@ do_it_again:
break;
}
timeout = schedule_timeout(timeout);
+ msleep(20);
continue;
}
__set_current_state(TASK_RUNNING);
===== With a process: =====
while (1) {
int fd = open(argv[1], O_RDWR);
read(fd, buf, sizeof(buf));
close(fd);
}
===== and its child: =====
setsid();
while (1) {
int fd = open(tty, O_RDWR|O_NOCTTY);
ioctl(fd, TIOCSCTTY, 1);
vhangup();
close(fd);
usleep(100 * (10 + random() % 1000));
}
===== EOF =====
References: https://bugzilla.novell.com/show_bug.cgi?id=693374
References: https://bugzilla.novell.com/show_bug.cgi?id=694509
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: stable <stable@kernel.org> [32, 33, 34, 39]
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-06-05 20:16:16 +08:00
|
|
|
ret = wait_event_timeout(tty_ldisc_idle,
|
TTY: restore tty_ldisc_wait_idle
It was removed in 65b770468e98 (tty-ldisc: turn ldisc user count into
a proper refcount), but we need to wait for last user to quit the
ldisc before we close it in tty_set_ldisc.
Otherwise weird things start to happen. There might be processes
waiting in tty_read->n_tty_read on tty->read_wait for input to appear
and at that moment, a change of ldisc is fatal. n_tty_close is called,
it frees read_buf and the waiting process is still in the middle of
reading and goes nuts after it is woken.
Previously we prevented close to happen when others are in ldisc ops
by tty_ldisc_wait_idle in tty_set_ldisc. But the commit above removed
that. So revoke the change and test whether there is 1 user (=we), and
allow the close then.
We can do that without ldisc/tty locks, because nobody else can open
the device due to TTY_LDISC_CHANGING bit set, so we in fact wait for
everybody to leave.
I don't understand why tty_ldisc_lock would be needed either when the
counter is an atomic variable, so this is a lockless
tty_ldisc_wait_idle.
On the other hand, if we fail to wait (timeout or signal), we have to
reenable the halted ldiscs, so we take ldisc lock and reuse the setup
path at the end of tty_set_ldisc.
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Acked-by: Linus Torvalds <torvalds@linux-foundation.org>
Tested-by: Sebastian Andrzej Siewior <bigeasy@breakpoint.cc>
LKML-Reference: <20101031104136.GA511@Chamillionaire.breakpoint.cc>
LKML-Reference: <1287669539-22644-1-git-send-email-jslaby@suse.cz>
Cc: Alan Cox <alan@linux.intel.com>
Cc: stable@kernel.org [32, 33, 36]
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-11-01 06:17:51 +08:00
|
|
|
atomic_read(&tty->ldisc->users) == 1, 5 * HZ);
|
|
|
|
|
if (ret < 0)
|
|
|
|
|
return ret;
|
|
|
|
|
return ret > 0 ? 0 : -EBUSY;
|
|
|
|
|
}
|
|
|
|
|
|
2008-07-22 18:16:55 +08:00
|
|
|
/**
|
|
|
|
|
* tty_set_ldisc - set line discipline
|
|
|
|
|
* @tty: the terminal to set
|
|
|
|
|
* @ldisc: the line discipline
|
|
|
|
|
*
|
|
|
|
|
* Set the discipline of a tty line. Must be called from a process
|
2009-06-11 19:50:12 +08:00
|
|
|
* context. The ldisc change logic has to protect itself against any
|
|
|
|
|
* overlapping ldisc change (including on the other end of pty pairs),
|
|
|
|
|
* the close of one side of a tty/pty pair, and eventually hangup.
|
2008-07-22 18:16:55 +08:00
|
|
|
*
|
2009-06-11 19:50:12 +08:00
|
|
|
* Locking: takes tty_ldisc_lock, termios_mutex
|
2008-07-22 18:16:55 +08:00
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
int tty_set_ldisc(struct tty_struct *tty, int ldisc)
|
|
|
|
|
{
|
|
|
|
|
int retval;
|
2009-06-11 19:50:12 +08:00
|
|
|
struct tty_ldisc *o_ldisc, *new_ldisc;
|
|
|
|
|
int work, o_work = 0;
|
2008-07-22 18:16:55 +08:00
|
|
|
struct tty_struct *o_tty;
|
|
|
|
|
|
2009-06-11 19:50:12 +08:00
|
|
|
new_ldisc = tty_ldisc_get(ldisc);
|
|
|
|
|
if (IS_ERR(new_ldisc))
|
|
|
|
|
return PTR_ERR(new_ldisc);
|
2008-07-22 18:16:55 +08:00
|
|
|
|
2010-06-02 04:53:01 +08:00
|
|
|
tty_lock();
|
2008-07-22 18:16:55 +08:00
|
|
|
/*
|
2009-06-11 19:50:12 +08:00
|
|
|
* We need to look at the tty locking here for pty/tty pairs
|
|
|
|
|
* when both sides try to change in parallel.
|
2008-07-22 18:16:55 +08:00
|
|
|
*/
|
|
|
|
|
|
2009-06-11 19:50:12 +08:00
|
|
|
o_tty = tty->link; /* o_tty is the pty side or NULL */
|
|
|
|
|
|
2008-07-22 18:16:55 +08:00
|
|
|
|
2009-06-11 19:50:12 +08:00
|
|
|
/*
|
|
|
|
|
* Check the no-op case
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
if (tty->ldisc->ops->num == ldisc) {
|
2010-06-02 04:53:01 +08:00
|
|
|
tty_unlock();
|
2009-06-11 19:50:12 +08:00
|
|
|
tty_ldisc_put(new_ldisc);
|
2008-07-22 18:16:55 +08:00
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
2010-06-02 04:53:01 +08:00
|
|
|
tty_unlock();
|
2009-06-11 19:50:12 +08:00
|
|
|
/*
|
|
|
|
|
* Problem: What do we do if this blocks ?
|
|
|
|
|
* We could deadlock here
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
tty_wait_until_sent(tty, 0);
|
|
|
|
|
|
2010-06-02 04:53:06 +08:00
|
|
|
tty_lock();
|
2009-06-11 19:50:12 +08:00
|
|
|
mutex_lock(&tty->ldisc_mutex);
|
|
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* We could be midstream of another ldisc change which has
|
|
|
|
|
* dropped the lock during processing. If so we need to wait.
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
while (test_bit(TTY_LDISC_CHANGING, &tty->flags)) {
|
|
|
|
|
mutex_unlock(&tty->ldisc_mutex);
|
2010-06-02 04:53:06 +08:00
|
|
|
tty_unlock();
|
2009-06-11 19:50:12 +08:00
|
|
|
wait_event(tty_ldisc_wait,
|
|
|
|
|
test_bit(TTY_LDISC_CHANGING, &tty->flags) == 0);
|
2010-06-02 04:53:06 +08:00
|
|
|
tty_lock();
|
2009-06-11 19:50:12 +08:00
|
|
|
mutex_lock(&tty->ldisc_mutex);
|
|
|
|
|
}
|
2009-11-30 21:18:29 +08:00
|
|
|
|
2009-06-11 19:50:12 +08:00
|
|
|
set_bit(TTY_LDISC_CHANGING, &tty->flags);
|
2009-06-11 19:51:41 +08:00
|
|
|
|
2008-07-22 18:16:55 +08:00
|
|
|
/*
|
|
|
|
|
* No more input please, we are switching. The new ldisc
|
|
|
|
|
* will update this value in the ldisc open function
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
tty->receive_room = 0;
|
|
|
|
|
|
|
|
|
|
o_ldisc = tty->ldisc;
|
2009-11-30 21:18:29 +08:00
|
|
|
|
2010-06-02 04:53:01 +08:00
|
|
|
tty_unlock();
|
2008-07-22 18:16:55 +08:00
|
|
|
/*
|
|
|
|
|
* Make sure we don't change while someone holds a
|
|
|
|
|
* reference to the line discipline. The TTY_LDISC bit
|
|
|
|
|
* prevents anyone taking a reference once it is clear.
|
|
|
|
|
* We need the lock to avoid racing reference takers.
|
2009-01-02 21:44:56 +08:00
|
|
|
*
|
|
|
|
|
* We must clear the TTY_LDISC bit here to avoid a livelock
|
|
|
|
|
* with a userspace app continually trying to use the tty in
|
|
|
|
|
* parallel to the change and re-referencing the tty.
|
2008-07-22 18:16:55 +08:00
|
|
|
*/
|
|
|
|
|
|
2009-06-11 19:50:12 +08:00
|
|
|
work = tty_ldisc_halt(tty);
|
2008-07-22 18:16:55 +08:00
|
|
|
if (o_tty)
|
2009-06-11 19:50:12 +08:00
|
|
|
o_work = tty_ldisc_halt(o_tty);
|
2008-07-22 18:16:55 +08:00
|
|
|
|
|
|
|
|
/*
|
2009-06-11 19:50:12 +08:00
|
|
|
* Wait for ->hangup_work and ->buf.work handlers to terminate.
|
|
|
|
|
* We must drop the mutex here in case a hangup is also in process.
|
2008-07-22 18:16:55 +08:00
|
|
|
*/
|
2009-06-11 19:50:12 +08:00
|
|
|
|
|
|
|
|
mutex_unlock(&tty->ldisc_mutex);
|
|
|
|
|
|
2011-01-25 00:54:12 +08:00
|
|
|
tty_ldisc_flush_works(tty);
|
2009-06-11 19:50:12 +08:00
|
|
|
|
TTY: restore tty_ldisc_wait_idle
It was removed in 65b770468e98 (tty-ldisc: turn ldisc user count into
a proper refcount), but we need to wait for last user to quit the
ldisc before we close it in tty_set_ldisc.
Otherwise weird things start to happen. There might be processes
waiting in tty_read->n_tty_read on tty->read_wait for input to appear
and at that moment, a change of ldisc is fatal. n_tty_close is called,
it frees read_buf and the waiting process is still in the middle of
reading and goes nuts after it is woken.
Previously we prevented close to happen when others are in ldisc ops
by tty_ldisc_wait_idle in tty_set_ldisc. But the commit above removed
that. So revoke the change and test whether there is 1 user (=we), and
allow the close then.
We can do that without ldisc/tty locks, because nobody else can open
the device due to TTY_LDISC_CHANGING bit set, so we in fact wait for
everybody to leave.
I don't understand why tty_ldisc_lock would be needed either when the
counter is an atomic variable, so this is a lockless
tty_ldisc_wait_idle.
On the other hand, if we fail to wait (timeout or signal), we have to
reenable the halted ldiscs, so we take ldisc lock and reuse the setup
path at the end of tty_set_ldisc.
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Acked-by: Linus Torvalds <torvalds@linux-foundation.org>
Tested-by: Sebastian Andrzej Siewior <bigeasy@breakpoint.cc>
LKML-Reference: <20101031104136.GA511@Chamillionaire.breakpoint.cc>
LKML-Reference: <1287669539-22644-1-git-send-email-jslaby@suse.cz>
Cc: Alan Cox <alan@linux.intel.com>
Cc: stable@kernel.org [32, 33, 36]
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-11-01 06:17:51 +08:00
|
|
|
retval = tty_ldisc_wait_idle(tty);
|
|
|
|
|
|
2010-06-02 04:53:01 +08:00
|
|
|
tty_lock();
|
2010-06-02 04:53:06 +08:00
|
|
|
mutex_lock(&tty->ldisc_mutex);
|
TTY: restore tty_ldisc_wait_idle
It was removed in 65b770468e98 (tty-ldisc: turn ldisc user count into
a proper refcount), but we need to wait for last user to quit the
ldisc before we close it in tty_set_ldisc.
Otherwise weird things start to happen. There might be processes
waiting in tty_read->n_tty_read on tty->read_wait for input to appear
and at that moment, a change of ldisc is fatal. n_tty_close is called,
it frees read_buf and the waiting process is still in the middle of
reading and goes nuts after it is woken.
Previously we prevented close to happen when others are in ldisc ops
by tty_ldisc_wait_idle in tty_set_ldisc. But the commit above removed
that. So revoke the change and test whether there is 1 user (=we), and
allow the close then.
We can do that without ldisc/tty locks, because nobody else can open
the device due to TTY_LDISC_CHANGING bit set, so we in fact wait for
everybody to leave.
I don't understand why tty_ldisc_lock would be needed either when the
counter is an atomic variable, so this is a lockless
tty_ldisc_wait_idle.
On the other hand, if we fail to wait (timeout or signal), we have to
reenable the halted ldiscs, so we take ldisc lock and reuse the setup
path at the end of tty_set_ldisc.
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Acked-by: Linus Torvalds <torvalds@linux-foundation.org>
Tested-by: Sebastian Andrzej Siewior <bigeasy@breakpoint.cc>
LKML-Reference: <20101031104136.GA511@Chamillionaire.breakpoint.cc>
LKML-Reference: <1287669539-22644-1-git-send-email-jslaby@suse.cz>
Cc: Alan Cox <alan@linux.intel.com>
Cc: stable@kernel.org [32, 33, 36]
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-11-01 06:17:51 +08:00
|
|
|
|
|
|
|
|
/* handle wait idle failure locked */
|
|
|
|
|
if (retval) {
|
|
|
|
|
tty_ldisc_put(new_ldisc);
|
|
|
|
|
goto enable;
|
|
|
|
|
}
|
|
|
|
|
|
2009-06-11 19:50:12 +08:00
|
|
|
if (test_bit(TTY_HUPPED, &tty->flags)) {
|
|
|
|
|
/* We were raced by the hangup method. It will have stomped
|
|
|
|
|
the ldisc data and closed the ldisc down */
|
|
|
|
|
clear_bit(TTY_LDISC_CHANGING, &tty->flags);
|
|
|
|
|
mutex_unlock(&tty->ldisc_mutex);
|
|
|
|
|
tty_ldisc_put(new_ldisc);
|
2010-06-02 04:53:01 +08:00
|
|
|
tty_unlock();
|
2009-06-11 19:50:12 +08:00
|
|
|
return -EIO;
|
|
|
|
|
}
|
|
|
|
|
|
2008-07-22 18:16:55 +08:00
|
|
|
/* Shutdown the current discipline. */
|
2009-06-11 19:50:12 +08:00
|
|
|
tty_ldisc_close(tty, o_ldisc);
|
2008-07-22 18:16:55 +08:00
|
|
|
|
|
|
|
|
/* Now set up the new line discipline. */
|
2009-06-11 19:50:12 +08:00
|
|
|
tty_ldisc_assign(tty, new_ldisc);
|
2008-07-22 18:16:55 +08:00
|
|
|
tty_set_termios_ldisc(tty, ldisc);
|
2009-06-11 19:50:12 +08:00
|
|
|
|
|
|
|
|
retval = tty_ldisc_open(tty, new_ldisc);
|
2008-07-22 18:16:55 +08:00
|
|
|
if (retval < 0) {
|
2009-06-11 19:50:12 +08:00
|
|
|
/* Back to the old one or N_TTY if we can't */
|
|
|
|
|
tty_ldisc_put(new_ldisc);
|
|
|
|
|
tty_ldisc_restore(tty, o_ldisc);
|
2008-07-22 18:16:55 +08:00
|
|
|
}
|
2009-06-11 19:50:12 +08:00
|
|
|
|
2008-07-22 18:16:55 +08:00
|
|
|
/* At this point we hold a reference to the new ldisc and a
|
|
|
|
|
a reference to the old ldisc. If we ended up flipping back
|
|
|
|
|
to the existing ldisc we have two references to it */
|
|
|
|
|
|
2009-06-11 19:50:12 +08:00
|
|
|
if (tty->ldisc->ops->num != o_ldisc->ops->num && tty->ops->set_ldisc)
|
2008-07-22 18:16:55 +08:00
|
|
|
tty->ops->set_ldisc(tty);
|
|
|
|
|
|
2009-06-11 19:50:12 +08:00
|
|
|
tty_ldisc_put(o_ldisc);
|
2008-07-22 18:16:55 +08:00
|
|
|
|
TTY: restore tty_ldisc_wait_idle
It was removed in 65b770468e98 (tty-ldisc: turn ldisc user count into
a proper refcount), but we need to wait for last user to quit the
ldisc before we close it in tty_set_ldisc.
Otherwise weird things start to happen. There might be processes
waiting in tty_read->n_tty_read on tty->read_wait for input to appear
and at that moment, a change of ldisc is fatal. n_tty_close is called,
it frees read_buf and the waiting process is still in the middle of
reading and goes nuts after it is woken.
Previously we prevented close to happen when others are in ldisc ops
by tty_ldisc_wait_idle in tty_set_ldisc. But the commit above removed
that. So revoke the change and test whether there is 1 user (=we), and
allow the close then.
We can do that without ldisc/tty locks, because nobody else can open
the device due to TTY_LDISC_CHANGING bit set, so we in fact wait for
everybody to leave.
I don't understand why tty_ldisc_lock would be needed either when the
counter is an atomic variable, so this is a lockless
tty_ldisc_wait_idle.
On the other hand, if we fail to wait (timeout or signal), we have to
reenable the halted ldiscs, so we take ldisc lock and reuse the setup
path at the end of tty_set_ldisc.
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Acked-by: Linus Torvalds <torvalds@linux-foundation.org>
Tested-by: Sebastian Andrzej Siewior <bigeasy@breakpoint.cc>
LKML-Reference: <20101031104136.GA511@Chamillionaire.breakpoint.cc>
LKML-Reference: <1287669539-22644-1-git-send-email-jslaby@suse.cz>
Cc: Alan Cox <alan@linux.intel.com>
Cc: stable@kernel.org [32, 33, 36]
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-11-01 06:17:51 +08:00
|
|
|
enable:
|
2008-07-22 18:16:55 +08:00
|
|
|
/*
|
2009-06-11 19:50:12 +08:00
|
|
|
* Allow ldisc referencing to occur again
|
2008-07-22 18:16:55 +08:00
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
tty_ldisc_enable(tty);
|
|
|
|
|
if (o_tty)
|
|
|
|
|
tty_ldisc_enable(o_tty);
|
|
|
|
|
|
2009-06-11 19:50:12 +08:00
|
|
|
/* Restart the work queue in case no characters kick it off. Safe if
|
2008-07-22 18:16:55 +08:00
|
|
|
already running */
|
|
|
|
|
if (work)
|
2011-03-23 07:17:32 +08:00
|
|
|
schedule_work(&tty->buf.work);
|
2009-06-11 19:50:12 +08:00
|
|
|
if (o_work)
|
2011-03-23 07:17:32 +08:00
|
|
|
schedule_work(&o_tty->buf.work);
|
2009-06-11 19:50:12 +08:00
|
|
|
mutex_unlock(&tty->ldisc_mutex);
|
2010-06-02 04:53:01 +08:00
|
|
|
tty_unlock();
|
2008-07-22 18:16:55 +08:00
|
|
|
return retval;
|
|
|
|
|
}
|
|
|
|
|
|
2009-06-11 19:50:12 +08:00
|
|
|
/**
|
|
|
|
|
* tty_reset_termios - reset terminal state
|
|
|
|
|
* @tty: tty to reset
|
|
|
|
|
*
|
|
|
|
|
* Restore a terminal to the driver default state.
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
static void tty_reset_termios(struct tty_struct *tty)
|
|
|
|
|
{
|
|
|
|
|
mutex_lock(&tty->termios_mutex);
|
|
|
|
|
*tty->termios = tty->driver->init_termios;
|
|
|
|
|
tty->termios->c_ispeed = tty_termios_input_baud_rate(tty->termios);
|
|
|
|
|
tty->termios->c_ospeed = tty_termios_baud_rate(tty->termios);
|
|
|
|
|
mutex_unlock(&tty->termios_mutex);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* tty_ldisc_reinit - reinitialise the tty ldisc
|
|
|
|
|
* @tty: tty to reinit
|
2010-02-08 18:09:26 +08:00
|
|
|
* @ldisc: line discipline to reinitialize
|
2009-06-11 19:50:12 +08:00
|
|
|
*
|
2010-02-08 18:09:26 +08:00
|
|
|
* Switch the tty to a line discipline and leave the ldisc
|
|
|
|
|
* state closed
|
2009-06-11 19:50:12 +08:00
|
|
|
*/
|
|
|
|
|
|
2010-10-27 23:13:21 +08:00
|
|
|
static int tty_ldisc_reinit(struct tty_struct *tty, int ldisc)
|
2009-06-11 19:50:12 +08:00
|
|
|
{
|
2010-10-27 23:13:21 +08:00
|
|
|
struct tty_ldisc *ld = tty_ldisc_get(ldisc);
|
|
|
|
|
|
|
|
|
|
if (IS_ERR(ld))
|
|
|
|
|
return -1;
|
2009-06-11 19:50:12 +08:00
|
|
|
|
TTY: ldisc, do not close until there are readers
We restored tty_ldisc_wait_idle in 100eeae2c5c (TTY: restore
tty_ldisc_wait_idle). We used it in the ldisc changing path to fix the
case where there are tasks in n_tty_read waiting for data and somebody
tries to change ldisc.
Similar to the case above, there may be also tasks waiting in
n_tty_read while hangup is performed. As 65b770468e98 (tty-ldisc: turn
ldisc user count into a proper refcount) removed the wait-until-idle
from all paths, hangup path won't wait for them to disappear either
now. So add it back even to the hangup path.
There is a difference, we need uninterruptible sleep as there is
obviously HUP signal pending. So tty_ldisc_wait_idle now sleeps
without possibility to be interrupted. This is what original
tty_ldisc_wait_idle did. After the wait idle reintroduction
(100eeae2c5c), we have had interruptible sleeps for the ldisc changing
path. But as there is a 5s timeout anyway, we don't allow it to be
interrupted from now on. It's not worth the added complexity of
deciding what kind of sleep we want.
Before 65b770468e98 tty_ldisc_release was called also from
tty_ldisc_release. It is called from tty_release, so I don't think we
need to restore that one.
This is nicely reproducible after constifying the timing when
drivers/tty/n_tty.c is patched as follows ("TTY: ntty, add one more
sanity check" patch is needed to actually see it explode):
%% -1548,6 +1549,7 @@ static int n_tty_open(struct tty_struct *tty)
/* These are ugly. Currently a malloc failure here can panic */
if (!tty->read_buf) {
+ msleep(100);
tty->read_buf = kzalloc(N_TTY_BUF_SIZE, GFP_KERNEL);
if (!tty->read_buf)
return -ENOMEM;
%% -1785,6 +1788,7 @@ do_it_again:
break;
}
timeout = schedule_timeout(timeout);
+ msleep(20);
continue;
}
__set_current_state(TASK_RUNNING);
===== With a process: =====
while (1) {
int fd = open(argv[1], O_RDWR);
read(fd, buf, sizeof(buf));
close(fd);
}
===== and its child: =====
setsid();
while (1) {
int fd = open(tty, O_RDWR|O_NOCTTY);
ioctl(fd, TIOCSCTTY, 1);
vhangup();
close(fd);
usleep(100 * (10 + random() % 1000));
}
===== EOF =====
References: https://bugzilla.novell.com/show_bug.cgi?id=693374
References: https://bugzilla.novell.com/show_bug.cgi?id=694509
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: stable <stable@kernel.org> [32, 33, 34, 39]
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-06-05 20:16:16 +08:00
|
|
|
WARN_ON_ONCE(tty_ldisc_wait_idle(tty));
|
|
|
|
|
|
2009-06-11 19:50:12 +08:00
|
|
|
tty_ldisc_close(tty, tty->ldisc);
|
|
|
|
|
tty_ldisc_put(tty->ldisc);
|
|
|
|
|
tty->ldisc = NULL;
|
|
|
|
|
/*
|
|
|
|
|
* Switch the line discipline back
|
|
|
|
|
*/
|
|
|
|
|
tty_ldisc_assign(tty, ld);
|
2010-02-08 18:09:26 +08:00
|
|
|
tty_set_termios_ldisc(tty, ldisc);
|
2010-10-27 23:13:21 +08:00
|
|
|
|
|
|
|
|
return 0;
|
2009-06-11 19:50:12 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* tty_ldisc_hangup - hangup ldisc reset
|
|
|
|
|
* @tty: tty being hung up
|
|
|
|
|
*
|
|
|
|
|
* Some tty devices reset their termios when they receive a hangup
|
|
|
|
|
* event. In that situation we must also switch back to N_TTY properly
|
|
|
|
|
* before we reset the termios data.
|
|
|
|
|
*
|
|
|
|
|
* Locking: We can take the ldisc mutex as the rest of the code is
|
|
|
|
|
* careful to allow for this.
|
|
|
|
|
*
|
|
|
|
|
* In the pty pair case this occurs in the close() path of the
|
|
|
|
|
* tty itself so we must be careful about locking rules.
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
void tty_ldisc_hangup(struct tty_struct *tty)
|
|
|
|
|
{
|
|
|
|
|
struct tty_ldisc *ld;
|
2010-02-08 18:09:26 +08:00
|
|
|
int reset = tty->driver->flags & TTY_DRIVER_RESET_TERMIOS;
|
|
|
|
|
int err = 0;
|
2009-06-11 19:50:12 +08:00
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* FIXME! What are the locking issues here? This may me overdoing
|
|
|
|
|
* things... This question is especially important now that we've
|
|
|
|
|
* removed the irqlock.
|
|
|
|
|
*/
|
|
|
|
|
ld = tty_ldisc_ref(tty);
|
|
|
|
|
if (ld != NULL) {
|
|
|
|
|
/* We may have no line discipline at this point */
|
|
|
|
|
if (ld->ops->flush_buffer)
|
|
|
|
|
ld->ops->flush_buffer(tty);
|
|
|
|
|
tty_driver_flush_buffer(tty);
|
|
|
|
|
if ((test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) &&
|
|
|
|
|
ld->ops->write_wakeup)
|
|
|
|
|
ld->ops->write_wakeup(tty);
|
|
|
|
|
if (ld->ops->hangup)
|
|
|
|
|
ld->ops->hangup(tty);
|
|
|
|
|
tty_ldisc_deref(ld);
|
|
|
|
|
}
|
|
|
|
|
/*
|
|
|
|
|
* FIXME: Once we trust the LDISC code better we can wait here for
|
|
|
|
|
* ldisc completion and fix the driver call race
|
|
|
|
|
*/
|
|
|
|
|
wake_up_interruptible_poll(&tty->write_wait, POLLOUT);
|
|
|
|
|
wake_up_interruptible_poll(&tty->read_wait, POLLIN);
|
|
|
|
|
/*
|
|
|
|
|
* Shutdown the current line discipline, and reset it to
|
2010-02-08 18:09:26 +08:00
|
|
|
* N_TTY if need be.
|
|
|
|
|
*
|
|
|
|
|
* Avoid racing set_ldisc or tty_ldisc_release
|
2009-06-11 19:50:12 +08:00
|
|
|
*/
|
2010-02-08 18:09:26 +08:00
|
|
|
mutex_lock(&tty->ldisc_mutex);
|
2010-06-02 04:53:06 +08:00
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* this is like tty_ldisc_halt, but we need to give up
|
2011-03-23 07:17:32 +08:00
|
|
|
* the BTM before calling cancel_work_sync, which may
|
|
|
|
|
* need to wait for another function taking the BTM
|
2010-06-02 04:53:06 +08:00
|
|
|
*/
|
|
|
|
|
clear_bit(TTY_LDISC, &tty->flags);
|
|
|
|
|
tty_unlock();
|
2011-03-23 07:17:32 +08:00
|
|
|
cancel_work_sync(&tty->buf.work);
|
2010-06-02 04:53:06 +08:00
|
|
|
mutex_unlock(&tty->ldisc_mutex);
|
|
|
|
|
|
|
|
|
|
tty_lock();
|
|
|
|
|
mutex_lock(&tty->ldisc_mutex);
|
|
|
|
|
|
2010-02-08 18:09:26 +08:00
|
|
|
/* At this point we have a closed ldisc and we want to
|
|
|
|
|
reopen it. We could defer this to the next open but
|
|
|
|
|
it means auditing a lot of other paths so this is
|
|
|
|
|
a FIXME */
|
|
|
|
|
if (tty->ldisc) { /* Not yet closed */
|
|
|
|
|
if (reset == 0) {
|
2010-10-27 23:13:21 +08:00
|
|
|
|
|
|
|
|
if (!tty_ldisc_reinit(tty, tty->termios->c_line))
|
|
|
|
|
err = tty_ldisc_open(tty, tty->ldisc);
|
|
|
|
|
else
|
|
|
|
|
err = 1;
|
2010-02-08 18:09:26 +08:00
|
|
|
}
|
|
|
|
|
/* If the re-open fails or we reset then go to N_TTY. The
|
|
|
|
|
N_TTY open cannot fail */
|
|
|
|
|
if (reset || err) {
|
2010-10-27 23:13:21 +08:00
|
|
|
BUG_ON(tty_ldisc_reinit(tty, N_TTY));
|
2009-07-16 23:05:08 +08:00
|
|
|
WARN_ON(tty_ldisc_open(tty, tty->ldisc));
|
|
|
|
|
}
|
2010-02-08 18:09:26 +08:00
|
|
|
tty_ldisc_enable(tty);
|
2009-06-11 19:50:12 +08:00
|
|
|
}
|
2010-02-08 18:09:26 +08:00
|
|
|
mutex_unlock(&tty->ldisc_mutex);
|
|
|
|
|
if (reset)
|
|
|
|
|
tty_reset_termios(tty);
|
2009-06-11 19:50:12 +08:00
|
|
|
}
|
2008-07-22 18:16:55 +08:00
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* tty_ldisc_setup - open line discipline
|
|
|
|
|
* @tty: tty being shut down
|
|
|
|
|
* @o_tty: pair tty for pty/tty pairs
|
|
|
|
|
*
|
|
|
|
|
* Called during the initial open of a tty/pty pair in order to set up the
|
2009-06-11 19:50:12 +08:00
|
|
|
* line disciplines and bind them to the tty. This has no locking issues
|
|
|
|
|
* as the device isn't yet active.
|
2008-07-22 18:16:55 +08:00
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
int tty_ldisc_setup(struct tty_struct *tty, struct tty_struct *o_tty)
|
|
|
|
|
{
|
2009-06-11 19:50:12 +08:00
|
|
|
struct tty_ldisc *ld = tty->ldisc;
|
2008-07-22 18:16:55 +08:00
|
|
|
int retval;
|
|
|
|
|
|
2009-06-11 19:50:12 +08:00
|
|
|
retval = tty_ldisc_open(tty, ld);
|
|
|
|
|
if (retval)
|
|
|
|
|
return retval;
|
|
|
|
|
|
|
|
|
|
if (o_tty) {
|
|
|
|
|
retval = tty_ldisc_open(o_tty, o_tty->ldisc);
|
2008-07-22 18:16:55 +08:00
|
|
|
if (retval) {
|
2009-06-11 19:50:12 +08:00
|
|
|
tty_ldisc_close(tty, ld);
|
2008-07-22 18:16:55 +08:00
|
|
|
return retval;
|
|
|
|
|
}
|
|
|
|
|
tty_ldisc_enable(o_tty);
|
|
|
|
|
}
|
|
|
|
|
tty_ldisc_enable(tty);
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
/**
|
|
|
|
|
* tty_ldisc_release - release line discipline
|
|
|
|
|
* @tty: tty being shut down
|
|
|
|
|
* @o_tty: pair tty for pty/tty pairs
|
|
|
|
|
*
|
2009-06-11 19:51:41 +08:00
|
|
|
* Called during the final close of a tty/pty pair in order to shut down
|
|
|
|
|
* the line discpline layer. On exit the ldisc assigned is N_TTY and the
|
2009-06-11 19:50:12 +08:00
|
|
|
* ldisc has not been opened.
|
2008-07-22 18:16:55 +08:00
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
void tty_ldisc_release(struct tty_struct *tty, struct tty_struct *o_tty)
|
|
|
|
|
{
|
|
|
|
|
/*
|
|
|
|
|
* Prevent flush_to_ldisc() from rescheduling the work for later. Then
|
|
|
|
|
* kill any delayed work. As this is the final close it does not
|
|
|
|
|
* race with the set_ldisc code path.
|
|
|
|
|
*/
|
|
|
|
|
|
2010-06-02 04:53:06 +08:00
|
|
|
tty_unlock();
|
2009-06-11 19:48:02 +08:00
|
|
|
tty_ldisc_halt(tty);
|
2011-01-25 00:54:12 +08:00
|
|
|
tty_ldisc_flush_works(tty);
|
2010-06-02 04:53:06 +08:00
|
|
|
tty_lock();
|
2008-07-22 18:16:55 +08:00
|
|
|
|
2009-07-16 23:05:08 +08:00
|
|
|
mutex_lock(&tty->ldisc_mutex);
|
2008-07-22 18:16:55 +08:00
|
|
|
/*
|
2009-06-29 22:21:47 +08:00
|
|
|
* Now kill off the ldisc
|
2008-07-22 18:16:55 +08:00
|
|
|
*/
|
2009-06-29 22:21:47 +08:00
|
|
|
tty_ldisc_close(tty, tty->ldisc);
|
|
|
|
|
tty_ldisc_put(tty->ldisc);
|
|
|
|
|
/* Force an oops if we mess this up */
|
|
|
|
|
tty->ldisc = NULL;
|
|
|
|
|
|
|
|
|
|
/* Ensure the next open requests the N_TTY ldisc */
|
|
|
|
|
tty_set_termios_ldisc(tty, N_TTY);
|
2009-07-16 23:05:08 +08:00
|
|
|
mutex_unlock(&tty->ldisc_mutex);
|
2008-07-22 18:16:55 +08:00
|
|
|
|
2009-06-11 19:50:12 +08:00
|
|
|
/* This will need doing differently if we need to lock */
|
|
|
|
|
if (o_tty)
|
|
|
|
|
tty_ldisc_release(o_tty, NULL);
|
2009-06-29 22:21:47 +08:00
|
|
|
|
|
|
|
|
/* And the memory resources remaining (buffers, termios) will be
|
|
|
|
|
disposed of when the kref hits zero */
|
2008-07-22 18:16:55 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* tty_ldisc_init - ldisc setup for new tty
|
|
|
|
|
* @tty: tty being allocated
|
|
|
|
|
*
|
|
|
|
|
* Set up the line discipline objects for a newly allocated tty. Note that
|
|
|
|
|
* the tty structure is not completely set up when this call is made.
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
void tty_ldisc_init(struct tty_struct *tty)
|
|
|
|
|
{
|
2009-06-11 19:50:12 +08:00
|
|
|
struct tty_ldisc *ld = tty_ldisc_get(N_TTY);
|
|
|
|
|
if (IS_ERR(ld))
|
2008-07-22 18:16:55 +08:00
|
|
|
panic("n_tty: init_tty");
|
2009-06-11 19:50:12 +08:00
|
|
|
tty_ldisc_assign(tty, ld);
|
2008-07-22 18:16:55 +08:00
|
|
|
}
|
|
|
|
|
|
2011-03-23 17:48:35 +08:00
|
|
|
/**
|
|
|
|
|
* tty_ldisc_init - ldisc cleanup for new tty
|
|
|
|
|
* @tty: tty that was allocated recently
|
|
|
|
|
*
|
|
|
|
|
* The tty structure must not becompletely set up (tty_ldisc_setup) when
|
|
|
|
|
* this call is made.
|
|
|
|
|
*/
|
|
|
|
|
void tty_ldisc_deinit(struct tty_struct *tty)
|
|
|
|
|
{
|
|
|
|
|
put_ldisc(tty->ldisc);
|
|
|
|
|
tty_ldisc_assign(tty, NULL);
|
|
|
|
|
}
|
|
|
|
|
|
2008-07-22 18:16:55 +08:00
|
|
|
void tty_ldisc_begin(void)
|
|
|
|
|
{
|
|
|
|
|
/* Setup the default TTY line discipline. */
|
|
|
|
|
(void) tty_register_ldisc(N_TTY, &tty_ldisc_N_TTY);
|
|
|
|
|
}
|