Commit 043b3a2b authored Oct 16, 2014 by Peter Hurley Committed by Girish Mahadevan Apr 26, 2016

serial: core: Flush ldisc after dropping port mutex in uart_close()



The tty buffers (and any line discipline buffers) must be flushed after
the UART hardware has shutdown; otherwise, a racing open on the same
tty may receive data from the previous session, which is a security
hazard. However, holding the port mutex while flushing the line
discipline buffers creates a lock inversion if the set_termios()
handler takes the port mutex (as it does in the followup patch,
'serial: Fix locking for uart driver set_termios method'.

Flush the ldisc buffers after dropping the port mutex; the tty lock
is still held which prevents a concurrent open() from advancing while
flushing. Since no new rx data is possible after uart_shutdown() until
a new open reinitializes the port, the later flush has no impact on
what data is being discarded.

Change-Id: I9cc27fe6ecb93b53c9899552bf8fdf871277e779
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Git-commit: 2e758910832dce99761a29688b33fd77dcbf6f6c
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git


Signed-off-by: Girish Mahadevan <girishm@codeaurora.org>

parent 59332181

drivers/tty/serial/serial_core.c

+2 −3

Original line number	Diff line number	Diff line
		@@ -1364,9 +1364,6 @@ static void uart_close(struct tty_struct tty, struct file filp)

		mutex_lock(&port->mutex);
		uart_shutdown(tty, state);

		tty_ldisc_flush(tty);

		tty_port_tty_set(port, NULL);
		tty->closing = 0;
		spin_lock_irqsave(&port->lock, flags);
		@@ -1393,6 +1390,8 @@ static void uart_close(struct tty_struct tty, struct file filp)
		wake_up_interruptible(&port->close_wait);

		mutex_unlock(&port->mutex);

		tty_ldisc_flush(tty);
		}

		static void uart_wait_until_sent(struct tty_struct *tty, int timeout)