n_tty: Fix echo race

svn path=/dists/trunk/linux-2.6/; revision=13989

debian/changelog

@@ -38,6 +38,9 @@ linux-2.6 (2.6.31~rc3-1~experimental.1) UNRELEASED; urgency=low
   [ Moritz Muehlenhoff ]
   * Fix Linus' name in copyright file (Closes: #530620)
 
+  [ dann frazier ]
+  * n_tty: Fix echo race
+
  -- maximilian attems <maks@debian.org>  Thu, 18 Jun 2009 23:50:56 +0200
 
 linux-2.6 (2.6.30-1) unstable; urgency=low

debian/patches/bugfix/all/n_tty-fix-echo-race.patch

@@ -0,0 +1,49 @@
+commit 807708844979ba8c6d5717345a8608454992696d
+Author: Alan Cox <alan@linux.intel.com>
+Date:   Thu Jul 16 16:07:03 2009 +0100
+
+    n_tty: Fix echo race
+    
+    If a tty in N_TTY mode with echo enabled manages to get itself into a state
+    where
+    	- echo characters are pending
+    	- FASYNC is enabled
+    	- tty_write_wakeup is called from either
+    		- a device write path (pty)
+    		- an IRQ (serial)
+    
+    then it either deadlocks or explodes taking a mutex in the IRQ path.
+    
+    On the serial side it is almost impossible to reproduce because you have to
+    go from a full serial port to a near empty one with echo characters
+    pending. The pty case happens to have become possible to trigger using
+    emacs and ptys, the pty changes having created a scenario which shows up
+    this bug.
+    
+    The code path is
+    
+    	n_tty:process_echoes() (takes mutex)
+    	tty_io:tty_put_char()
+    	pty:pty_write  (or serial paths)
+    	tty_wakeup     (from pty_write or serial IRQ)
+    	n_tty_write_wakeup()
+    	process_echoes()
+    	*KABOOM*
+    
+    Signed-off-by: Alan Cox <alan@linux.intel.com>
+    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+
+diff --git a/drivers/char/n_tty.c b/drivers/char/n_tty.c
+index 94a5d50..ff47907 100644
+--- a/drivers/char/n_tty.c
++++ b/drivers/char/n_tty.c
+@@ -1331,9 +1331,6 @@ handle_newline:
+ 
+ static void n_tty_write_wakeup(struct tty_struct *tty)
+ {
+-	/* Write out any echoed characters that are still pending */
+-	process_echoes(tty);
+-
+ 	if (tty->fasync && test_and_clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags))
+ 		kill_fasync(&tty->fasync, SIGIO, POLL_OUT);
+ }

debian/patches/series/base

@@ -30,3 +30,4 @@
 #+ bugfix/arm/export-flush_dcache_page.patch
 + bugfix/all/add-missing-mtd-include.patch
 + bugfix/mips/fix-smp.patch
++ bugfix/all/n_tty-fix-echo-race.patch