Commit ee0c1a65 authored by Peter Hurley's avatar Peter Hurley Committed by Greg Kroah-Hartman
Browse files

tty: Fix tty_send_xchar() lock order inversion 



The correct lock order is atomic_write_lock => termios_rwsem, as
established by tty_write() => n_tty_write().

Fixes: c274f6ef ("tty: Hold termios_rwsem for tcflow(TCIxxx)")
Reported-and-Tested-by: default avatarDmitry Vyukov <dvyukov@google.com>
Cc: <stable@vger.kernel.org> # v3.18+
Signed-off-by: default avatarPeter Hurley <peter@hurleysoftware.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 8005c49d

drivers/tty/tty_io.c

+4 −0
Original line number Diff line number Diff line
@@ -1282,18 +1282,22 @@ int tty_send_xchar(struct tty_struct *tty, char ch) 
	int	was_stopped = tty->stopped;



	if (tty->ops->send_xchar) {

		down_read(&tty->termios_rwsem);

		tty->ops->send_xchar(tty, ch);

		up_read(&tty->termios_rwsem);

		return 0;

	}



	if (tty_write_lock(tty, 0) < 0)

		return -ERESTARTSYS;



	down_read(&tty->termios_rwsem);

	if (was_stopped)

		start_tty(tty);

	tty->ops->write(tty, &ch, 1);

	if (was_stopped)

		stop_tty(tty);

	up_read(&tty->termios_rwsem);

	tty_write_unlock(tty);

	return 0;

}

drivers/tty/tty_ioctl.c

+0 −4
Original line number Diff line number Diff line
@@ -1147,16 +1147,12 @@ int n_tty_ioctl_helper(struct tty_struct *tty, struct file *file, 
			spin_unlock_irq(&tty->flow_lock);

			break;

		case TCIOFF:

			down_read(&tty->termios_rwsem);

			if (STOP_CHAR(tty) != __DISABLED_CHAR)

				retval = tty_send_xchar(tty, STOP_CHAR(tty));

			up_read(&tty->termios_rwsem);

			break;

		case TCION:

			down_read(&tty->termios_rwsem);

			if (START_CHAR(tty) != __DISABLED_CHAR)

				retval = tty_send_xchar(tty, START_CHAR(tty));

			up_read(&tty->termios_rwsem);

			break;

		default:

			return -EINVAL;

CRA Git | Maintained and supported by SUSTech CRA and CCSE