iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tty: Fix unsafe vt paste_selection()

Browse Source 
Convert the tty_buffer_flush() exclusion mechanism to a
public interface - tty_buffer_lock/unlock_exclusive() - and use
the interface to safely write the paste selection to the line
discipline.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Peter Hurley
2013-06-15 09:36:15 -04:00
committed by Greg Kroah-Hartman
parent 47aa658a01
commit a7c8d58c79
4 changed files with 56 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

61
drivers/tty/tty_buffer.c
View File

@ -29,6 +29,42 @@
#define TTYB_MEM_LIMIT 65536
/**
* tty_buffer_lock_exclusive - gain exclusive access to buffer
* tty_buffer_unlock_exclusive - release exclusive access
*
* @port - tty_port owning the flip buffer
*
* Guarantees safe use of the line discipline's receive_buf() method by
* excluding the buffer work and any pending flush from using the flip
* buffer. Data can continue to be added concurrently to the flip buffer
* from the driver side.
*
* On release, the buffer work is restarted if there is data in the
* flip buffer
*/
void tty_buffer_lock_exclusive(struct tty_port *port)
{
struct tty_bufhead *buf = &port->buf;
atomic_inc(&buf->priority);
mutex_lock(&buf->lock);
}
void tty_buffer_unlock_exclusive(struct tty_port *port)
{
struct tty_bufhead *buf = &port->buf;
int restart;
restart = buf->head->commit != buf->head->read;
atomic_dec(&buf->priority);
mutex_unlock(&buf->lock);
if (restart)
queue_work(system_unbound_wq, &buf->work);
}
/**
* tty_buffer_space_avail - return unused buffer space
* @port - tty_port owning the flip buffer
@ -158,7 +194,7 @@ static void tty_buffer_free(struct tty_port *port, struct tty_buffer *b)
* being processed by flush_to_ldisc then we defer the processing
* to that function
*
* Locking: takes flush_mutex to ensure single-threaded flip buffer
* Locking: takes buffer lock to ensure single-threaded flip buffer
* 'consumer'
*/
@ -168,16 +204,16 @@ void tty_buffer_flush(struct tty_struct *tty)
struct tty_bufhead *buf = &port->buf;
struct tty_buffer *next;
buf->flushpending = 1;
atomic_inc(&buf->priority);
mutex_lock(&buf->flush_mutex);
mutex_lock(&buf->lock);
while ((next = buf->head->next) != NULL) {
tty_buffer_free(port, buf->head);
buf->head = next;
}
buf->head->read = buf->head->commit;
buf->flushpending = 0;
mutex_unlock(&buf->flush_mutex);
atomic_dec(&buf->priority);
mutex_unlock(&buf->lock);
}
/**
@ -383,7 +419,7 @@ receive_buf(struct tty_struct *tty, struct tty_buffer *head, int count)
*
* The receive_buf method is single threaded for each tty instance.
*
* Locking: takes flush_mutex to ensure single-threaded flip buffer
* Locking: takes buffer lock to ensure single-threaded flip buffer
* 'consumer'
*/
@ -402,14 +438,14 @@ static void flush_to_ldisc(struct work_struct *work)
if (disc == NULL)
return;
mutex_lock(&buf->flush_mutex);
mutex_lock(&buf->lock);
while (1) {
struct tty_buffer *head = buf->head;
int count;
/* Ldisc or user is trying to flush the buffers. */
if (buf->flushpending)
/* Ldisc or user is trying to gain exclusive access */
if (atomic_read(&buf->priority))
break;
count = head->commit - head->read;
@ -426,7 +462,7 @@ static void flush_to_ldisc(struct work_struct *work)
break;
}
mutex_unlock(&buf->flush_mutex);
mutex_unlock(&buf->lock);
tty_ldisc_deref(disc);
}
@ -482,13 +518,12 @@ void tty_buffer_init(struct tty_port *port)
{
struct tty_bufhead *buf = &port->buf;
mutex_init(&buf->flush_mutex);
mutex_init(&buf->lock);
tty_buffer_reset(&buf->sentinel, 0);
buf->head = &buf->sentinel;
buf->tail = &buf->sentinel;
init_llist_head(&buf->free);
atomic_set(&buf->memory_used, 0);
buf->flushpending = 0;
atomic_set(&buf->priority, 0);
INIT_WORK(&buf->work, flush_to_ldisc);
}