diff options
| author | Peter Hurley <peter@hurleysoftware.com> | 2014-10-16 20:54:19 (GMT) |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2014-11-06 02:53:54 (GMT) |
| commit | 2e758910832dce99761a29688b33fd77dcbf6f6c (patch) | |
| tree | 792bf3c623230c21a325dfe8bf91dda9d26af96a /drivers/tty/serial/serial_core.c | |
| parent | 479e9b94fdce7bc46f669831012fc12f56696fd7 (diff) | |
| download | linux-2e758910832dce99761a29688b33fd77dcbf6f6c.tar.xz | |
serial: core: Flush ldisc after dropping port mutex in uart_close()
The tty buffers (and any line discipline buffers) must be flushed after
the UART hardware has shutdown; otherwise, a racing open on the same
tty may receive data from the previous session, which is a security
hazard. However, holding the port mutex while flushing the line
discipline buffers creates a lock inversion if the set_termios()
handler takes the port mutex (as it does in the followup patch,
'serial: Fix locking for uart driver set_termios method'.
Flush the ldisc buffers after dropping the port mutex; the tty lock
is still held which prevents a concurrent open() from advancing while
flushing. Since no new rx data is possible after uart_shutdown() until
a new open reinitializes the port, the later flush has no impact on
what data is being discarded.
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/tty/serial/serial_core.c')
| -rw-r--r-- | drivers/tty/serial/serial_core.c | 5 |
1 files changed, 2 insertions, 3 deletions
diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c index 787d67f..9d14297 100644 --- a/drivers/tty/serial/serial_core.c +++ b/drivers/tty/serial/serial_core.c @@ -1361,9 +1361,6 @@ static void uart_close(struct tty_struct *tty, struct file *filp) mutex_lock(&port->mutex); uart_shutdown(tty, state); - - tty_ldisc_flush(tty); - tty_port_tty_set(port, NULL); tty->closing = 0; spin_lock_irqsave(&port->lock, flags); @@ -1390,6 +1387,8 @@ static void uart_close(struct tty_struct *tty, struct file *filp) wake_up_interruptible(&port->close_wait); mutex_unlock(&port->mutex); + + tty_ldisc_flush(tty); } static void uart_wait_until_sent(struct tty_struct *tty, int timeout) |