TTY: move cdev_add to tty_register_device

We need the /dev/ node not to be available before we call
tty_register_device. Otherwise we might race with open and
tty_struct->port might not be available at that time.

This is not an issue now, but would be a problem after "TTY: use
tty_port_register_device" is applied.

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Acked-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2 files changed, 42 insertions, 8 deletions

diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 4d9898c2b641..28c3e869ebba 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -3006,6 +3006,15 @@ EXPORT_SYMBOL_GPL(tty_put_char);
 
 struct class *tty_class;
 
+static int tty_cdev_add(struct tty_driver *driver, dev_t dev,
+                unsigned int index, unsigned int count)
+{
+        /* init here, since reused cdevs cause crashes */
+        cdev_init(&driver->cdevs[index], &tty_fops);
+        driver->cdevs[index].owner = driver->owner;
+        return cdev_add(&driver->cdevs[index], dev, count);
+}
+
 /**
  *      tty_register_device - register a tty device
  *      @driver: the tty driver that describes the tty device
@@ -3028,8 +3037,10 @@ struct class *tty_class;
 struct device *tty_register_device(struct tty_driver *driver, unsigned index,
                                    struct device *device)
 {
+        struct device *ret;
         char name[64];
         dev_t dev = MKDEV(driver->major, driver->minor_start) + index;
+        bool cdev = false;
 
         if (index >= driver->num) {
                 printk(KERN_ERR "Attempt to register invalid tty line number "
@@ -3042,7 +3053,18 @@ struct device *tty_register_device(struct tty_driver *driver, unsigned index,
         else
                 tty_line_name(driver, index, name);
 
-        return device_create(tty_class, device, dev, NULL, name);
+        if (!(driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
+                int error = tty_cdev_add(driver, dev, index, 1);
+                if (error)
+                        return ERR_PTR(error);
+                cdev = true;
+        }
+
+        ret = device_create(tty_class, device, dev, NULL, name);
+        if (IS_ERR(ret) && cdev)
+                cdev_del(&driver->cdevs[index]);
+
+        return ret;
 }
 EXPORT_SYMBOL(tty_register_device);
 
@@ -3061,6 +3083,8 @@ void tty_unregister_device(struct tty_driver *driver, unsigned index)
 {
         device_destroy(tty_class,
                 MKDEV(driver->major, driver->minor_start) + index);
+        if (!(driver->flags & TTY_DRIVER_DYNAMIC_ALLOC))
+                cdev_del(&driver->cdevs[index]);
 }
 EXPORT_SYMBOL(tty_unregister_device);
 
@@ -3077,6 +3101,7 @@ struct tty_driver *__tty_alloc_driver(unsigned int lines, struct module *owner,
                 unsigned long flags)
 {
         struct tty_driver *driver;
+        unsigned int cdevs = 1;
         int err;
 
         if (!lines || (flags & TTY_DRIVER_UNNUMBERED_NODE && lines > 1))
@@ -3110,6 +3135,13 @@ struct tty_driver *__tty_alloc_driver(unsigned int lines, struct module *owner,
                         err = -ENOMEM;
                         goto err_free_all;
                 }
+                cdevs = lines;
+        }
+
+        driver->cdevs = kcalloc(cdevs, sizeof(*driver->cdevs), GFP_KERNEL);
+        if (!driver->cdevs) {
+                err = -ENOMEM;
+                goto err_free_all;
         }
 
         return driver;
@@ -3144,8 +3176,10 @@ static void destruct_tty_driver(struct kref *kref)
                                 tty_unregister_device(driver, i);
                 }
                 proc_tty_unregister_driver(driver);
-                cdev_del(&driver->cdev);
+                if (driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)
+                        cdev_del(&driver->cdevs[0]);
         }
+        kfree(driver->cdevs);
         kfree(driver->ports);
         kfree(driver->termios);
         kfree(driver->ttys);
@@ -3195,11 +3229,11 @@ int tty_register_driver(struct tty_driver *driver)
         if (error < 0)
                 goto err;
 
-        cdev_init(&driver->cdev, &tty_fops);
-        driver->cdev.owner = driver->owner;
-        error = cdev_add(&driver->cdev, dev, driver->num);
-        if (error)
-                goto err_unreg_char;
+        if (driver->flags & TTY_DRIVER_DYNAMIC_ALLOC) {
+                error = tty_cdev_add(driver, dev, 0, driver->num);
+                if (error)
+                        goto err_unreg_char;
+        }
 
         mutex_lock(&tty_mutex);
         list_add(&driver->tty_drivers, &tty_drivers);
diff --git a/include/linux/tty_driver.h b/include/linux/tty_driver.h
index 44e05b75d573..dd976cfb6131 100644
--- a/include/linux/tty_driver.h
+++ b/include/linux/tty_driver.h
@@ -289,7 +289,7 @@ struct tty_operations {
 struct tty_driver {
         int     magic;          /* magic number for this structure */
         struct kref kref;       /* Reference management */
-        struct cdev cdev;
+        struct cdev *cdevs;
         struct module   *owner;
         const char      *driver_name;
         const char      *name;