tty: rewrite the ldisc locking

There are several pretty much unfixable races in the old ldisc code, especially
with respect to pty behaviour and also to hangup. It's easier to rewrite the
code than simply try and patch it up.

This patch
- splits the ldisc from the tty (so we will be able to refcount it more cleanly
  later)
- introduces a mutex lock for ldisc changing on an active device
- fixes the complete mess that hangup caused
- implements hopefully correct setldisc/close/hangup locking

There are still some problems around pty pairs that have always been there but
at least it is now possible to understand the code and fix further problems.

This fixes the following known bugs
- hang up can leak ldisc references
- hang up may not call open/close on ldisc in a matched way
- pty/tty pairs can deadlock during an ldisc change
- reading the ldisc proc files can cause every ldisc to be loaded

and probably a few other of the mysterious ldisc race reports.

I'm sure it also adds the odd new one.

Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

1 files changed, 7 insertions, 2 deletions

diff --git a/include/linux/tty.h b/include/linux/tty.h
index f9c13c83790c..1488d8c81aac 100644
--- a/include/linux/tty.h
+++ b/include/linux/tty.h
@@ -226,8 +226,11 @@ struct tty_struct {
         struct tty_driver *driver;
         const struct tty_operations *ops;
         int index;
-        /* The ldisc objects are protected by tty_ldisc_lock at the moment */
-        struct tty_ldisc ldisc;
+
+        /* Protects ldisc changes: Lock tty not pty */
+        struct mutex ldisc_mutex;
+        struct tty_ldisc *ldisc;
+
         struct mutex termios_mutex;
         spinlock_t ctrl_lock;
         /* Termios values are protected by the termios mutex */
@@ -314,6 +317,7 @@ struct tty_struct {
 #define TTY_CLOSING             7       /* ->close() in progress */
 #define TTY_LDISC               9       /* Line discipline attached */
 #define TTY_LDISC_CHANGING      10      /* Line discipline changing */
+#define TTY_LDISC_OPEN          11      /* Line discipline is open */
 #define TTY_HW_COOK_OUT         14      /* Hardware can do output cooking */
 #define TTY_HW_COOK_IN          15      /* Hardware can do input cooking */
 #define TTY_PTY_LOCK            16      /* pty private */
@@ -406,6 +410,7 @@ extern int tty_termios_hw_change(struct ktermios *a, struct ktermios *b);
 extern struct tty_ldisc *tty_ldisc_ref(struct tty_struct *);
 extern void tty_ldisc_deref(struct tty_ldisc *);
 extern struct tty_ldisc *tty_ldisc_ref_wait(struct tty_struct *);
+extern void tty_ldisc_hangup(struct tty_struct *tty);
 extern const struct file_operations tty_ldiscs_proc_fops;
 
 extern void tty_wakeup(struct tty_struct *tty);