Merge tag 'tty-4.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

Pull tty/serial fixes from Greg KH:
 "Here's some TTY and serial driver fixes for reported issues.

  All of these have been in linux-next successfully"

* tag 'tty-4.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
  pty: Fix input race when closing
  tty/n_gsm.c: fix a memory leak when gsmtty is removed
  Revert "serial/amba-pl011: Leave the TX IRQ alone when the UART is not open"
  serial: omap: Fix error handling in probe
  earlycon: Revert log warnings

10 files changed, 64 insertions, 34 deletions

diff --git a/Documentation/serial/tty.txt b/Documentation/serial/tty.txt
index 1e52d67d0abf..dbe6623fed1c 100644
--- a/Documentation/serial/tty.txt
+++ b/Documentation/serial/tty.txt
@@ -198,6 +198,9 @@ TTY_IO_ERROR		If set, causes all subsequent userspace read/write
 
 TTY_OTHER_CLOSED        Device is a pty and the other side has closed.
 
+TTY_OTHER_DONE          Device is a pty and the other side has closed and
+                        all pending input processing has been completed.
+
 TTY_NO_WRITE_SPLIT      Prevent driver from splitting up writes into
                         smaller chunks.
 
diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
index 91abc00aa833..2c34c3249972 100644
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -3170,7 +3170,7 @@ static int gsmtty_break_ctl(struct tty_struct *tty, int state)
         return gsmtty_modem_update(dlci, encode);
 }
 
-static void gsmtty_remove(struct tty_driver *driver, struct tty_struct *tty)
+static void gsmtty_cleanup(struct tty_struct *tty)
 {
         struct gsm_dlci *dlci = tty->driver_data;
         struct gsm_mux *gsm = dlci->gsm;
@@ -3178,7 +3178,6 @@ static void gsmtty_remove(struct tty_driver *driver, struct tty_struct *tty)
         dlci_put(dlci);
         dlci_put(gsm->dlci[0]);
         mux_put(gsm);
-        driver->ttys[tty->index] = NULL;
 }
 
 /* Virtual ttys for the demux */
@@ -3199,7 +3198,7 @@ static const struct tty_operations gsmtty_ops = {
         .tiocmget               = gsmtty_tiocmget,
         .tiocmset               = gsmtty_tiocmset,
         .break_ctl              = gsmtty_break_ctl,
-        .remove                 = gsmtty_remove,
+        .cleanup                = gsmtty_cleanup,
 };
 
 
diff --git a/drivers/tty/n_hdlc.c b/drivers/tty/n_hdlc.c
index 644ddb841d9f..bbc4ce66c2c1 100644
--- a/drivers/tty/n_hdlc.c
+++ b/drivers/tty/n_hdlc.c
@@ -600,7 +600,7 @@ static ssize_t n_hdlc_tty_read(struct tty_struct *tty, struct file *file,
         add_wait_queue(&tty->read_wait, &wait);
 
         for (;;) {
-                if (test_bit(TTY_OTHER_CLOSED, &tty->flags)) {
+                if (test_bit(TTY_OTHER_DONE, &tty->flags)) {
                         ret = -EIO;
                         break;
                 }
@@ -828,7 +828,7 @@ static unsigned int n_hdlc_tty_poll(struct tty_struct *tty, struct file *filp,
                 /* set bits for operations that won't block */
                 if (n_hdlc->rx_buf_list.head)
                         mask |= POLLIN | POLLRDNORM;    /* readable */
-                if (test_bit(TTY_OTHER_CLOSED, &tty->flags))
+                if (test_bit(TTY_OTHER_DONE, &tty->flags))
                         mask |= POLLHUP;
                 if (tty_hung_up_p(filp))
                         mask |= POLLHUP;
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index cf6e0f2e1331..cc57a3a6b02b 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -1949,6 +1949,18 @@ static inline int input_available_p(struct tty_struct *tty, int poll)
                 return ldata->commit_head - ldata->read_tail >= amt;
 }
 
+static inline int check_other_done(struct tty_struct *tty)
+{
+        int done = test_bit(TTY_OTHER_DONE, &tty->flags);
+        if (done) {
+                /* paired with cmpxchg() in check_other_closed(); ensures
+                 * read buffer head index is not stale
+                 */
+                smp_mb__after_atomic();
+        }
+        return done;
+}
+
 /**
  *      copy_from_read_buf      -       copy read data directly
  *      @tty: terminal device
@@ -2167,7 +2179,7 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,
         struct n_tty_data *ldata = tty->disc_data;
         unsigned char __user *b = buf;
         DEFINE_WAIT_FUNC(wait, woken_wake_function);
-        int c;
+        int c, done;
         int minimum, time;
         ssize_t retval = 0;
         long timeout;
@@ -2235,8 +2247,10 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,
                     ((minimum - (b - buf)) >= 1))
                         ldata->minimum_to_wake = (minimum - (b - buf));
 
+                done = check_other_done(tty);
+
                 if (!input_available_p(tty, 0)) {
-                        if (test_bit(TTY_OTHER_CLOSED, &tty->flags)) {
+                        if (done) {
                                 retval = -EIO;
                                 break;
                         }
@@ -2443,12 +2457,12 @@ static unsigned int n_tty_poll(struct tty_struct *tty, struct file *file,
 
         poll_wait(file, &tty->read_wait, wait);
         poll_wait(file, &tty->write_wait, wait);
+        if (check_other_done(tty))
+                mask |= POLLHUP;
         if (input_available_p(tty, 1))
                 mask |= POLLIN | POLLRDNORM;
         if (tty->packet && tty->link->ctrl_status)
                 mask |= POLLPRI | POLLIN | POLLRDNORM;
-        if (test_bit(TTY_OTHER_CLOSED, &tty->flags))
-                mask |= POLLHUP;
         if (tty_hung_up_p(file))
                 mask |= POLLHUP;
         if (!(mask & (POLLHUP | POLLIN | POLLRDNORM))) {
diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
index e72ee629cead..4d5e8409769c 100644
--- a/drivers/tty/pty.c
+++ b/drivers/tty/pty.c
@@ -53,9 +53,8 @@ static void pty_close(struct tty_struct *tty, struct file *filp)
         /* Review - krefs on tty_link ?? */
         if (!tty->link)
                 return;
-        tty_flush_to_ldisc(tty->link);
         set_bit(TTY_OTHER_CLOSED, &tty->link->flags);
-        wake_up_interruptible(&tty->link->read_wait);
+        tty_flip_buffer_push(tty->link->port);
         wake_up_interruptible(&tty->link->write_wait);
         if (tty->driver->subtype == PTY_TYPE_MASTER) {
                 set_bit(TTY_OTHER_CLOSED, &tty->flags);
@@ -243,7 +242,9 @@ static int pty_open(struct tty_struct *tty, struct file *filp)
                 goto out;
 
         clear_bit(TTY_IO_ERROR, &tty->flags);
+        /* TTY_OTHER_CLOSED must be cleared before TTY_OTHER_DONE */
         clear_bit(TTY_OTHER_CLOSED, &tty->link->flags);
+        clear_bit(TTY_OTHER_DONE, &tty->link->flags);
         set_bit(TTY_THROTTLED, &tty->flags);
         return 0;
 
diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
index 5a4e9d579585..6f5a0720a8c8 100644
--- a/drivers/tty/serial/amba-pl011.c
+++ b/drivers/tty/serial/amba-pl011.c
@@ -1639,6 +1639,9 @@ static int pl011_startup(struct uart_port *port)
 
         writew(uap->vendor->ifls, uap->port.membase + UART011_IFLS);
 
+        /* Assume that TX IRQ doesn't work until we see one: */
+        uap->tx_irq_seen = 0;
+
         spin_lock_irq(&uap->port.lock);
 
         /* restore RTS and DTR */
@@ -1702,7 +1705,7 @@ static void pl011_shutdown(struct uart_port *port)
         spin_lock_irq(&uap->port.lock);
         uap->im = 0;
         writew(uap->im, uap->port.membase + UART011_IMSC);
-        writew(0xffff & ~UART011_TXIS, uap->port.membase + UART011_ICR);
+        writew(0xffff, uap->port.membase + UART011_ICR);
         spin_unlock_irq(&uap->port.lock);
 
         pl011_dma_shutdown(uap);
diff --git a/drivers/tty/serial/earlycon.c b/drivers/tty/serial/earlycon.c
index 5fdc9f3ecd64..6dc471e30e79 100644
--- a/drivers/tty/serial/earlycon.c
+++ b/drivers/tty/serial/earlycon.c
@@ -187,13 +187,8 @@ static int __init param_setup_earlycon(char *buf)
                 return 0;
 
         err = setup_earlycon(buf);
-        if (err == -ENOENT) {
-                pr_warn("no match for %s\n", buf);
-                err = 0;
-        } else if (err == -EALREADY) {
-                pr_warn("already registered\n");
-                err = 0;
-        }
+        if (err == -ENOENT || err == -EALREADY)
+                return 0;
         return err;
 }
 early_param("earlycon", param_setup_earlycon);
diff --git a/drivers/tty/serial/omap-serial.c b/drivers/tty/serial/omap-serial.c
index 211479aa34bb..7f49172ccd86 100644
--- a/drivers/tty/serial/omap-serial.c
+++ b/drivers/tty/serial/omap-serial.c
@@ -1735,6 +1735,8 @@ static int serial_omap_probe(struct platform_device *pdev)
 err_add_port:
         pm_runtime_put(&pdev->dev);
         pm_runtime_disable(&pdev->dev);
+        pm_qos_remove_request(&up->pm_qos_request);
+        device_init_wakeup(up->dev, false);
 err_rs485:
 err_port_line:
         return ret;
diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c
index 75661641f5fe..2f78b77f0f81 100644
--- a/drivers/tty/tty_buffer.c
+++ b/drivers/tty/tty_buffer.c
@@ -37,6 +37,28 @@
 
 #define TTY_BUFFER_PAGE (((PAGE_SIZE - sizeof(struct tty_buffer)) / 2) & ~0xFF)
 
+/*
+ * If all tty flip buffers have been processed by flush_to_ldisc() or
+ * dropped by tty_buffer_flush(), check if the linked pty has been closed.
+ * If so, wake the reader/poll to process
+ */
+static inline void check_other_closed(struct tty_struct *tty)
+{
+        unsigned long flags, old;
+
+        /* transition from TTY_OTHER_CLOSED => TTY_OTHER_DONE must be atomic */
+        for (flags = ACCESS_ONCE(tty->flags);
+             test_bit(TTY_OTHER_CLOSED, &flags);
+             ) {
+                old = flags;
+                __set_bit(TTY_OTHER_DONE, &flags);
+                flags = cmpxchg(&tty->flags, old, flags);
+                if (old == flags) {
+                        wake_up_interruptible(&tty->read_wait);
+                        break;
+                }
+        }
+}
 
 /**
  *      tty_buffer_lock_exclusive       -       gain exclusive access to buffer
@@ -229,6 +251,8 @@ void tty_buffer_flush(struct tty_struct *tty, struct tty_ldisc *ld)
         if (ld && ld->ops->flush_buffer)
                 ld->ops->flush_buffer(tty);
 
+        check_other_closed(tty);
+
         atomic_dec(&buf->priority);
         mutex_unlock(&buf->lock);
 }
@@ -471,8 +495,10 @@ static void flush_to_ldisc(struct work_struct *work)
                 smp_rmb();
                 count = head->commit - head->read;
                 if (!count) {
-                        if (next == NULL)
+                        if (next == NULL) {
+                                check_other_closed(tty);
                                 break;
+                        }
                         buf->head = next;
                         tty_buffer_free(port, head);
                         continue;
@@ -489,19 +515,6 @@ static void flush_to_ldisc(struct work_struct *work)
 }
 
 /**
- *      tty_flush_to_ldisc
- *      @tty: tty to push
- *
- *      Push the terminal flip buffers to the line discipline.
- *
- *      Must not be called from IRQ context.
- */
-void tty_flush_to_ldisc(struct tty_struct *tty)
-{
-        flush_work(&tty->port->buf.work);
-}
-
-/**
  *      tty_flip_buffer_push    -       terminal
  *      @port: tty port to push
  *
diff --git a/include/linux/tty.h b/include/linux/tty.h
index fe5623c9af71..d76631f615c2 100644
--- a/include/linux/tty.h
+++ b/include/linux/tty.h
@@ -339,6 +339,7 @@ struct tty_file_private {
 #define TTY_EXCLUSIVE           3       /* Exclusive open mode */
 #define TTY_DEBUG               4       /* Debugging */
 #define TTY_DO_WRITE_WAKEUP     5       /* Call write_wakeup after queuing new */
+#define TTY_OTHER_DONE          6       /* Closed pty has completed input processing */
 #define TTY_LDISC_OPEN          11      /* Line discipline is open */
 #define TTY_PTY_LOCK            16      /* pty private */
 #define TTY_NO_WRITE_SPLIT      17      /* Preserve write boundaries to driver */
@@ -462,7 +463,6 @@ extern int tty_hung_up_p(struct file *filp);
 extern void do_SAK(struct tty_struct *tty);
 extern void __do_SAK(struct tty_struct *tty);
 extern void no_tty(void);
-extern void tty_flush_to_ldisc(struct tty_struct *tty);
 extern void tty_buffer_free_all(struct tty_port *port);
 extern void tty_buffer_flush(struct tty_struct *tty, struct tty_ldisc *ld);
 extern void tty_buffer_init(struct tty_port *port);