Revert "tty: make receive_buf() return the amout of bytes received"

This reverts commit b1c43f82c5aa265442f82dba31ce985ebb7aa71c.

It was broken in so many ways, and results in random odd pty issues.

It re-introduced the buggy schedule_work() in flush_to_ldisc() that can
cause endless work-loops (see commit a5660b41af6a: "tty: fix endless
work loop when the buffer fills up").

It also used an "unsigned int" return value fo the ->receive_buf()
function, but then made multiple functions return a negative error code,
and didn't actually check for the error in the caller.

And it didn't actually work at all.  BenH bisected down odd tty behavior
to it:
  "It looks like the patch is causing some major malfunctions of the X
   server for me, possibly related to PTYs.  For example, cat'ing a
   large file in a gnome terminal hangs the kernel for -minutes- in a
   loop of what looks like flush_to_ldisc/workqueue code, (some ftrace
   data in the quoted bits further down).

   ...

   Some more data: It -looks- like what happens is that the
   flush_to_ldisc work queue entry constantly re-queues itself (because
   the PTY is full ?) and the workqueue thread will basically loop
   forver calling it without ever scheduling, thus starving the consumer
   process that could have emptied the PTY."

which is pretty much exactly the problem we fixed in a5660b41af6a.

Milton Miller pointed out the 'unsigned int' issue.

Reported-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Reported-by: Milton Miller <miltonm@bga.com>
Cc: Stefan Bigler <stefan.bigler@keymile.com>
Cc: Toby Gray <toby.gray@realvnc.com>
Cc: Felipe Balbi <balbi@ti.com>
Cc: Greg Kroah-Hartman <gregkh@suse.de>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

6 files changed, 69 insertions, 44 deletions

diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
index a4c42a75a3b..09e8c7d53af 100644
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -2128,8 +2128,8 @@ static void gsmld_detach_gsm(struct tty_struct *tty, struct gsm_mux *gsm)
         gsm->tty = NULL;
 }
 
-static unsigned int gsmld_receive_buf(struct tty_struct *tty,
-                const unsigned char *cp, char *fp, int count)
+static void gsmld_receive_buf(struct tty_struct *tty, const unsigned char *cp,
+                              char *fp, int count)
 {
         struct gsm_mux *gsm = tty->disc_data;
         const unsigned char *dp;
@@ -2162,8 +2162,6 @@ static unsigned int gsmld_receive_buf(struct tty_struct *tty,
         }
         /* FASYNC if needed ? */
         /* If clogged call tty_throttle(tty); */
-
-        return count;
 }
 
 /**
diff --git a/drivers/tty/n_hdlc.c b/drivers/tty/n_hdlc.c
index cac666314ae..cea56033b34 100644
--- a/drivers/tty/n_hdlc.c
+++ b/drivers/tty/n_hdlc.c
@@ -188,8 +188,8 @@ static unsigned int n_hdlc_tty_poll(struct tty_struct *tty, struct file *filp,
                                     poll_table *wait);
 static int n_hdlc_tty_open(struct tty_struct *tty);
 static void n_hdlc_tty_close(struct tty_struct *tty);
-static unsigned int n_hdlc_tty_receive(struct tty_struct *tty,
-                const __u8 *cp, char *fp, int count);
+static void n_hdlc_tty_receive(struct tty_struct *tty, const __u8 *cp,
+                               char *fp, int count);
 static void n_hdlc_tty_wakeup(struct tty_struct *tty);
 
 #define bset(p,b)       ((p)[(b) >> 5] |= (1 << ((b) & 0x1f)))
@@ -509,8 +509,8 @@ static void n_hdlc_tty_wakeup(struct tty_struct *tty)
  * Called by tty low level driver when receive data is available. Data is
  * interpreted as one HDLC frame.
  */
-static unsigned int n_hdlc_tty_receive(struct tty_struct *tty,
-                const __u8 *data, char *flags, int count)
+static void n_hdlc_tty_receive(struct tty_struct *tty, const __u8 *data,
+                               char *flags, int count)
 {
         register struct n_hdlc *n_hdlc = tty2n_hdlc (tty);
         register struct n_hdlc_buf *buf;
@@ -521,20 +521,20 @@ static unsigned int n_hdlc_tty_receive(struct tty_struct *tty,
                 
         /* This can happen if stuff comes in on the backup tty */
         if (!n_hdlc || tty != n_hdlc->tty)
-                return -ENODEV;
+                return;
                 
         /* verify line is using HDLC discipline */
         if (n_hdlc->magic != HDLC_MAGIC) {
                 printk("%s(%d) line not using HDLC discipline\n",
                         __FILE__,__LINE__);
-                return -EINVAL;
+                return;
         }
         
         if ( count>maxframe ) {
                 if (debuglevel >= DEBUG_LEVEL_INFO)     
                         printk("%s(%d) rx count>maxframesize, data discarded\n",
                                __FILE__,__LINE__);
-                return -EINVAL;
+                return;
         }
 
         /* get a free HDLC buffer */    
@@ -550,7 +550,7 @@ static unsigned int n_hdlc_tty_receive(struct tty_struct *tty,
                 if (debuglevel >= DEBUG_LEVEL_INFO)     
                         printk("%s(%d) no more rx buffers, data discarded\n",
                                __FILE__,__LINE__);
-                return -EINVAL;
+                return;
         }
                 
         /* copy received data to HDLC buffer */
@@ -565,8 +565,6 @@ static unsigned int n_hdlc_tty_receive(struct tty_struct *tty,
         if (n_hdlc->tty->fasync != NULL)
                 kill_fasync (&n_hdlc->tty->fasync, SIGIO, POLL_IN);
 
-        return count;
-
 }       /* end of n_hdlc_tty_receive() */
 
 /**
diff --git a/drivers/tty/n_r3964.c b/drivers/tty/n_r3964.c
index a4bc39c21a4..5c6c31459a2 100644
--- a/drivers/tty/n_r3964.c
+++ b/drivers/tty/n_r3964.c
@@ -139,8 +139,8 @@ static int r3964_ioctl(struct tty_struct *tty, struct file *file,
 static void r3964_set_termios(struct tty_struct *tty, struct ktermios *old);
 static unsigned int r3964_poll(struct tty_struct *tty, struct file *file,
                 struct poll_table_struct *wait);
-static unsigned int r3964_receive_buf(struct tty_struct *tty,
-                const unsigned char *cp, char *fp, int count);
+static void r3964_receive_buf(struct tty_struct *tty, const unsigned char *cp,
+                char *fp, int count);
 
 static struct tty_ldisc_ops tty_ldisc_N_R3964 = {
         .owner = THIS_MODULE,
@@ -1239,8 +1239,8 @@ static unsigned int r3964_poll(struct tty_struct *tty, struct file *file,
         return result;
 }
 
-static unsigned int r3964_receive_buf(struct tty_struct *tty,
-                const unsigned char *cp, char *fp, int count)
+static void r3964_receive_buf(struct tty_struct *tty, const unsigned char *cp,
+                        char *fp, int count)
 {
         struct r3964_info *pInfo = tty->disc_data;
         const unsigned char *p;
@@ -1257,8 +1257,6 @@ static unsigned int r3964_receive_buf(struct tty_struct *tty,
                 }
 
         }
-
-        return count;
 }
 
 MODULE_LICENSE("GPL");
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index 95d0a9c2dd1..0ad32888091 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -81,6 +81,38 @@ static inline int tty_put_user(struct tty_struct *tty, unsigned char x,
         return put_user(x, ptr);
 }
 
+/**
+ *      n_tty_set__room -       receive space
+ *      @tty: terminal
+ *
+ *      Called by the driver to find out how much data it is
+ *      permitted to feed to the line discipline without any being lost
+ *      and thus to manage flow control. Not serialized. Answers for the
+ *      "instant".
+ */
+
+static void n_tty_set_room(struct tty_struct *tty)
+{
+        /* tty->read_cnt is not read locked ? */
+        int     left = N_TTY_BUF_SIZE - tty->read_cnt - 1;
+        int old_left;
+
+        /*
+         * If we are doing input canonicalization, and there are no
+         * pending newlines, let characters through without limit, so
+         * that erase characters will be handled.  Other excess
+         * characters will be beeped.
+         */
+        if (left <= 0)
+                left = tty->icanon && !tty->canon_data;
+        old_left = tty->receive_room;
+        tty->receive_room = left;
+
+        /* Did this open up the receive buffer? We may need to flip */
+        if (left && !old_left)
+                schedule_work(&tty->buf.work);
+}
+
 static void put_tty_queue_nolock(unsigned char c, struct tty_struct *tty)
 {
         if (tty->read_cnt < N_TTY_BUF_SIZE) {
@@ -152,6 +184,7 @@ static void reset_buffer_flags(struct tty_struct *tty)
 
         tty->canon_head = tty->canon_data = tty->erasing = 0;
         memset(&tty->read_flags, 0, sizeof tty->read_flags);
+        n_tty_set_room(tty);
         check_unthrottle(tty);
 }
 
@@ -1327,19 +1360,17 @@ static void n_tty_write_wakeup(struct tty_struct *tty)
  *      calls one at a time and in order (or using flush_to_ldisc)
  */
 
-static unsigned int n_tty_receive_buf(struct tty_struct *tty,
-                const unsigned char *cp, char *fp, int count)
+static void n_tty_receive_buf(struct tty_struct *tty, const unsigned char *cp,
+                              char *fp, int count)
 {
         const unsigned char *p;
         char *f, flags = TTY_NORMAL;
         int     i;
         char    buf[64];
         unsigned long cpuflags;
-        int left;
-        int ret = 0;
 
         if (!tty->read_buf)
-                return 0;
+                return;
 
         if (tty->real_raw) {
                 spin_lock_irqsave(&tty->read_lock, cpuflags);
@@ -1349,7 +1380,6 @@ static unsigned int n_tty_receive_buf(struct tty_struct *tty,
                 memcpy(tty->read_buf + tty->read_head, cp, i);
                 tty->read_head = (tty->read_head + i) & (N_TTY_BUF_SIZE-1);
                 tty->read_cnt += i;
-                ret += i;
                 cp += i;
                 count -= i;
 
@@ -1359,10 +1389,8 @@ static unsigned int n_tty_receive_buf(struct tty_struct *tty,
                 memcpy(tty->read_buf + tty->read_head, cp, i);
                 tty->read_head = (tty->read_head + i) & (N_TTY_BUF_SIZE-1);
                 tty->read_cnt += i;
-                ret += i;
                 spin_unlock_irqrestore(&tty->read_lock, cpuflags);
         } else {
-                ret = count;
                 for (i = count, p = cp, f = fp; i; i--, p++) {
                         if (f)
                                 flags = *f++;
@@ -1390,6 +1418,8 @@ static unsigned int n_tty_receive_buf(struct tty_struct *tty,
                         tty->ops->flush_chars(tty);
         }
 
+        n_tty_set_room(tty);
+
         if ((!tty->icanon && (tty->read_cnt >= tty->minimum_to_wake)) ||
                 L_EXTPROC(tty)) {
                 kill_fasync(&tty->fasync, SIGIO, POLL_IN);
@@ -1402,12 +1432,8 @@ static unsigned int n_tty_receive_buf(struct tty_struct *tty,
          * mode.  We don't want to throttle the driver if we're in
          * canonical mode and don't have a newline yet!
          */
-        left = N_TTY_BUF_SIZE - tty->read_cnt - 1;
-
-        if (left < TTY_THRESHOLD_THROTTLE)
+        if (tty->receive_room < TTY_THRESHOLD_THROTTLE)
                 tty_throttle(tty);
-
-        return ret;
 }
 
 int is_ignored(int sig)
@@ -1451,6 +1477,7 @@ static void n_tty_set_termios(struct tty_struct *tty, struct ktermios *old)
         if (test_bit(TTY_HW_COOK_IN, &tty->flags)) {
                 tty->raw = 1;
                 tty->real_raw = 1;
+                n_tty_set_room(tty);
                 return;
         }
         if (I_ISTRIP(tty) || I_IUCLC(tty) || I_IGNCR(tty) ||
@@ -1503,6 +1530,7 @@ static void n_tty_set_termios(struct tty_struct *tty, struct ktermios *old)
                 else
                         tty->real_raw = 0;
         }
+        n_tty_set_room(tty);
         /* The termios change make the tty ready for I/O */
         wake_up_interruptible(&tty->write_wait);
         wake_up_interruptible(&tty->read_wait);
@@ -1784,6 +1812,8 @@ do_it_again:
                                 retval = -ERESTARTSYS;
                                 break;
                         }
+                        /* FIXME: does n_tty_set_room need locking ? */
+                        n_tty_set_room(tty);
                         timeout = schedule_timeout(timeout);
                         continue;
                 }
@@ -1855,8 +1885,10 @@ do_it_again:
                  * longer than TTY_THRESHOLD_UNTHROTTLE in canonical mode,
                  * we won't get any more characters.
                  */
-                if (n_tty_chars_in_buffer(tty) <= TTY_THRESHOLD_UNTHROTTLE)
+                if (n_tty_chars_in_buffer(tty) <= TTY_THRESHOLD_UNTHROTTLE) {
+                        n_tty_set_room(tty);
                         check_unthrottle(tty);
+                }
 
                 if (b - buf >= minimum)
                         break;
@@ -1878,6 +1910,7 @@ do_it_again:
         } else if (test_and_clear_bit(TTY_PUSH, &tty->flags))
                  goto do_it_again;
 
+        n_tty_set_room(tty);
         return retval;
 }
 
diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c
index 46de2e075da..f1a7918d71a 100644
--- a/drivers/tty/tty_buffer.c
+++ b/drivers/tty/tty_buffer.c
@@ -416,7 +416,6 @@ static void flush_to_ldisc(struct work_struct *work)
                 struct tty_buffer *head, *tail = tty->buf.tail;
                 int seen_tail = 0;
                 while ((head = tty->buf.head) != NULL) {
-                        int copied;
                         int count;
                         char *char_buf;
                         unsigned char *flag_buf;
@@ -443,19 +442,17 @@ static void flush_to_ldisc(struct work_struct *work)
                            line discipline as we want to empty the queue */
                         if (test_bit(TTY_FLUSHPENDING, &tty->flags))
                                 break;
+                        if (!tty->receive_room || seen_tail)
+                                break;
+                        if (count > tty->receive_room)
+                                count = tty->receive_room;
                         char_buf = head->char_buf_ptr + head->read;
                         flag_buf = head->flag_buf_ptr + head->read;
+                        head->read += count;
                         spin_unlock_irqrestore(&tty->buf.lock, flags);
-                        copied = disc->ops->receive_buf(tty, char_buf,
+                        disc->ops->receive_buf(tty, char_buf,
                                                         flag_buf, count);
                         spin_lock_irqsave(&tty->buf.lock, flags);
-
-                        head->read += copied;
-
-                        if (copied == 0 || seen_tail) {
-                                schedule_work(&tty->buf.work);
-                                break;
-                        }
                 }
                 clear_bit(TTY_FLUSHING, &tty->flags);
         }
diff --git a/drivers/tty/vt/selection.c b/drivers/tty/vt/selection.c
index 67b1d0d7c8a..fb864e7fcd1 100644
--- a/drivers/tty/vt/selection.c
+++ b/drivers/tty/vt/selection.c
@@ -332,7 +332,8 @@ int paste_selection(struct tty_struct *tty)
                         continue;
                 }
                 count = sel_buffer_lth - pasted;
-                count = tty->ldisc->ops->receive_buf(tty, sel_buffer + pasted,
+                count = min(count, tty->receive_room);
+                tty->ldisc->ops->receive_buf(tty, sel_buffer + pasted,
                                                                 NULL, count);
                 pasted += count;
         }