linux-stable/drivers/tty
Corey Minyard 33d4ae9885 drivers:tty:pty: Fix a race causing data loss on close
Remove the tty_vhangup() from the pty code and just release the
redirect.  The tty_vhangup() results in data loss and data out of order
issues.

If you write to a pty master an immediately close the pty master, the
receiver might get a chunk of data dropped, but then receive some later
data.  That's obviously something rather unexpected for a user.  It
certainly confused my test program.

It turns out that tty_vhangup() on the slave pty gets called from
pty_close(), and that causes the data on the slave side to be flushed,
but due to races more data can be copied into the slave side's buffer
after that.  Consider the following sequence:

thread1          thread2         thread3
-------          -------         -------
 |                |-write data into buffer,
 |                | n_tty buffer is filled
 |                | along with other buffers
 |                |-pty_close(master)
 |                |--tty_vhangup(slave)
 |                |---tty_ldisc_hangup()
 |                |----n_tty_flush_buffer()
 |                |-----reset_buffer_flags()
 |-n_tty_read()   |
 |--up_read(&tty->termios_rwsem);
 |                |------down_read(&tty->termios_rwsem)
 |                |------clear n_tty buffer contents
 |                |------up_read(&tty->termios_rwsem)
 |--tty_buffer_flush_work()       |
 |--schedules work calling        |
 |  flush_to_ldisc()              |
 |                                |-flush_to_ldisc()
 |                                |--receive_buf()
 |                                |---tty_port_default_receive_buf()
 |                                |----tty_ldisc_receive_buf()
 |                                |-----n_tty_receive_buf2()
 |                                |------n_tty_receive_buf_common()
 |                                |-------down_read(&tty->termios_rwsem)
 |                                |-------__receive_buf()
 |                                |       copies data into n_tty buffer
 |                                |-------up_read(&tty->termios_rwsem)
 |--down_read(&tty->termios_rwsem)
 |--copy buffer data to user

>From this sequence, you can see that thread2 writes to the buffer then
only clears the part of the buffer in n_tty.  The n_tty receive buffer
code then copies more data into the n_tty buffer.

But part of the vhangup, releasing the redirect, is still required to
avoid issues with consoles running on pty slaves.  So do that.
As far as I can tell, that is all that should be required.

Signed-off-by: Corey Minyard <cminyard@mvista.com>
Link: https://lore.kernel.org/r/20201124004902.1398477-3-minyard@acm.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-01-07 16:30:55 +01:00
..
hvc tty_port: drop last traces of low_latency 2021-01-07 16:17:32 +01:00
ipwireless tty_port: drop last traces of low_latency 2021-01-07 16:17:32 +01:00
serdev tty: serdev: core: Provide missing description for 'owner' 2020-11-06 10:49:27 +01:00
serial serial: stm32: update transmission complete error message in shutdown 2021-01-07 16:19:29 +01:00
vt vt: drop old FONT ioctls 2021-01-07 16:17:31 +01:00
Kconfig printk changes for 5.11 2020-12-16 10:45:11 -08:00
Makefile printk changes for 5.11 2020-12-16 10:45:11 -08:00
amiserial.c tty_port: drop last traces of low_latency 2021-01-07 16:17:32 +01:00
cyclades.c treewide: Remove uninitialized_var() usage 2020-07-16 12:35:15 -07:00
ehv_bytechan.c
goldfish.c tty: goldfish: use __raw_writel()/__raw_readl() 2020-10-28 13:44:43 +01:00
isicom.c treewide: Remove uninitialized_var() usage 2020-07-16 12:35:15 -07:00
mips_ejtag_fdc.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
moxa.c
moxa.h tty: fix spelling mistake 2020-06-27 16:21:20 +02:00
mxser.c tty_port: drop last traces of low_latency 2021-01-07 16:17:32 +01:00
mxser.h
n_gsm.c tty: n_gsm: Demote obvious abuse of kernel-doc and supply other missing docss 2020-11-06 10:54:04 +01:00
n_hdlc.c Linux 5.9-rc3 2020-08-31 07:19:25 +02:00
n_null.c
n_r3964.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
n_tracerouter.c
n_tracesink.c
n_tracesink.h
n_tty.c tty: n_tty: Add 2 missing parameter descriptions 2020-11-06 10:49:27 +01:00
nozomi.c tty: nozomi: remove unneeded break 2020-10-28 13:44:43 +01:00
pty.c drivers:tty:pty: Fix a race causing data loss on close 2021-01-07 16:30:55 +01:00
rocket.c
rocket.h
rocket_int.h
synclink_gt.c tty_port: drop last traces of low_latency 2021-01-07 16:17:32 +01:00
sysrq.c tty/sysrq: Extend the sysrq_key_table to cover capital letters 2020-10-02 14:56:06 +02:00
tty_audit.c tty: tty_audit: Demote non-conformant kernel-doc headers 2020-11-06 10:54:04 +01:00
tty_baudrate.c tty: tty_baudrate: Add missing description for 'tty' 2020-11-06 10:49:27 +01:00
tty_buffer.c tty: tty_buffer: Add missing description for 'limit' 2020-11-06 10:49:27 +01:00
tty_io.c drivers:tty:pty: Fix a race causing data loss on close 2021-01-07 16:30:55 +01:00
tty_ioctl.c tty: Remove dead termiox code 2020-12-04 16:54:35 +01:00
tty_jobctrl.c Merge 5.10-rc7 into tty-next 2020-12-07 10:19:31 +01:00
tty_ldisc.c tty: tty_ldisc: Fix some kernel-doc related misdemeanours 2020-11-13 15:30:45 +01:00
tty_ldsem.c
tty_mutex.c
tty_port.c tty: tty_port: Demote obvious abuse of kernel-doc formatting 2020-11-06 10:49:27 +01:00
ttynull.c init/console: Use ttynull as a fallback when there is no console 2020-11-20 12:23:50 +01:00
vcc.c