tty: Fix hung task on pty hangup

When hanging up one end of a pty pair, there may be waiting
readers/writers on the other end which may not exit, preventing
tty_ldisc_lock_pair() from acquiring the other side's ldisc lock.

Only acquire this side's ldisc lock; although this will no longer
prevent the other side from writing new input, that input will not
be processing until after the ldisc hangup is complete.

Reported-by: Sasha Levin <sasha.levin@oracle.com>
Reviewed-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

1 files changed, 20 insertions, 2 deletions

diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c
index 5bdc241628ac..1dbe27824220 100644
--- a/drivers/tty/tty_ldisc.c
+++ b/drivers/tty/tty_ldisc.c
@@ -326,6 +326,24 @@ static inline void __tty_ldisc_unlock(struct tty_struct *tty)
 }
 
 static int __lockfunc
+tty_ldisc_lock(struct tty_struct *tty, unsigned long timeout)
+{
+        int ret;
+
+        ret = __tty_ldisc_lock(tty, timeout);
+        if (!ret)
+                return -EBUSY;
+        set_bit(TTY_LDISC_HALTED, &tty->flags);
+        return 0;
+}
+
+static void tty_ldisc_unlock(struct tty_struct *tty)
+{
+        clear_bit(TTY_LDISC_HALTED, &tty->flags);
+        __tty_ldisc_unlock(tty);
+}
+
+static int __lockfunc
 tty_ldisc_lock_pair_timeout(struct tty_struct *tty, struct tty_struct *tty2,
                             unsigned long timeout)
 {
@@ -682,7 +700,7 @@ void tty_ldisc_hangup(struct tty_struct *tty)
          *
          * Avoid racing set_ldisc or tty_ldisc_release
          */
-        tty_ldisc_lock_pair(tty, tty->link);
+        tty_ldisc_lock(tty, MAX_SCHEDULE_TIMEOUT);
 
         if (tty->ldisc) {
 
@@ -704,7 +722,7 @@ void tty_ldisc_hangup(struct tty_struct *tty)
                         WARN_ON(tty_ldisc_open(tty, tty->ldisc));
                 }
         }
-        tty_ldisc_enable_pair(tty, tty->link);
+        tty_ldisc_unlock(tty);
         if (reset)
                 tty_reset_termios(tty);