1 files changed, 51 insertions, 22 deletions

diff --git a/drivers/char/tty_ldisc.c b/drivers/char/tty_ldisc.c
index feb55075819b..500e740ec5e4 100644
--- a/drivers/char/tty_ldisc.c
+++ b/drivers/char/tty_ldisc.c
@@ -34,6 +34,8 @@
 #include <linux/vt_kern.h>
 #include <linux/selection.h>
 
+#include <linux/smp_lock.h>     /* For the moment */
+
 #include <linux/kmod.h>
 #include <linux/nsproxy.h>
 
@@ -443,8 +445,14 @@ static void tty_set_termios_ldisc(struct tty_struct *tty, int num)
 static int tty_ldisc_open(struct tty_struct *tty, struct tty_ldisc *ld)
 {
         WARN_ON(test_and_set_bit(TTY_LDISC_OPEN, &tty->flags));
-        if (ld->ops->open)
-                return ld->ops->open(tty);
+        if (ld->ops->open) {
+                int ret;
+                /* BKL here locks verus a hangup event */
+                lock_kernel();
+                ret = ld->ops->open(tty);
+                unlock_kernel();
+                return ret;
+        }
         return 0;
 }
 
@@ -545,6 +553,7 @@ int tty_set_ldisc(struct tty_struct *tty, int ldisc)
         if (IS_ERR(new_ldisc))
                 return PTR_ERR(new_ldisc);
 
+        lock_kernel();
         /*
          *      We need to look at the tty locking here for pty/tty pairs
          *      when both sides try to change in parallel.
@@ -558,10 +567,12 @@ int tty_set_ldisc(struct tty_struct *tty, int ldisc)
          */
 
         if (tty->ldisc->ops->num == ldisc) {
+                unlock_kernel();
                 tty_ldisc_put(new_ldisc);
                 return 0;
         }
 
+        unlock_kernel();
         /*
          *      Problem: What do we do if this blocks ?
          *      We could deadlock here
@@ -582,6 +593,9 @@ int tty_set_ldisc(struct tty_struct *tty, int ldisc)
                         test_bit(TTY_LDISC_CHANGING, &tty->flags) == 0);
                 mutex_lock(&tty->ldisc_mutex);
         }
+
+        lock_kernel();
+
         set_bit(TTY_LDISC_CHANGING, &tty->flags);
 
         /*
@@ -592,6 +606,8 @@ int tty_set_ldisc(struct tty_struct *tty, int ldisc)
         tty->receive_room = 0;
 
         o_ldisc = tty->ldisc;
+
+        unlock_kernel();
         /*
          *      Make sure we don't change while someone holds a
          *      reference to the line discipline. The TTY_LDISC bit
@@ -617,12 +633,14 @@ int tty_set_ldisc(struct tty_struct *tty, int ldisc)
         flush_scheduled_work();
 
         mutex_lock(&tty->ldisc_mutex);
+        lock_kernel();
         if (test_bit(TTY_HUPPED, &tty->flags)) {
                 /* We were raced by the hangup method. It will have stomped
                    the ldisc data and closed the ldisc down */
                 clear_bit(TTY_LDISC_CHANGING, &tty->flags);
                 mutex_unlock(&tty->ldisc_mutex);
                 tty_ldisc_put(new_ldisc);
+                unlock_kernel();
                 return -EIO;
         }
 
@@ -664,6 +682,7 @@ int tty_set_ldisc(struct tty_struct *tty, int ldisc)
         if (o_work)
                 schedule_delayed_work(&o_tty->buf.work, 1);
         mutex_unlock(&tty->ldisc_mutex);
+        unlock_kernel();
         return retval;
 }
 
@@ -687,12 +706,13 @@ static void tty_reset_termios(struct tty_struct *tty)
 /**
  *      tty_ldisc_reinit        -       reinitialise the tty ldisc
  *      @tty: tty to reinit
+ *      @ldisc: line discipline to reinitialize
  *
- *      Switch the tty back to N_TTY line discipline and leave the
- *      ldisc state closed
+ *      Switch the tty to a line discipline and leave the ldisc
+ *      state closed
  */
 
-static void tty_ldisc_reinit(struct tty_struct *tty)
+static void tty_ldisc_reinit(struct tty_struct *tty, int ldisc)
 {
         struct tty_ldisc *ld;
 
@@ -702,10 +722,10 @@ static void tty_ldisc_reinit(struct tty_struct *tty)
         /*
          *      Switch the line discipline back
          */
-        ld = tty_ldisc_get(N_TTY);
+        ld = tty_ldisc_get(ldisc);
         BUG_ON(IS_ERR(ld));
         tty_ldisc_assign(tty, ld);
-        tty_set_termios_ldisc(tty, N_TTY);
+        tty_set_termios_ldisc(tty, ldisc);
 }
 
 /**
@@ -726,6 +746,8 @@ static void tty_ldisc_reinit(struct tty_struct *tty)
 void tty_ldisc_hangup(struct tty_struct *tty)
 {
         struct tty_ldisc *ld;
+        int reset = tty->driver->flags & TTY_DRIVER_RESET_TERMIOS;
+        int err = 0;
 
         /*
          * FIXME! What are the locking issues here? This may me overdoing
@@ -753,25 +775,32 @@ void tty_ldisc_hangup(struct tty_struct *tty)
         wake_up_interruptible_poll(&tty->read_wait, POLLIN);
         /*
          * Shutdown the current line discipline, and reset it to
-         * N_TTY.
+         * N_TTY if need be.
+         *
+         * Avoid racing set_ldisc or tty_ldisc_release
          */
-        if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS) {
-                /* Avoid racing set_ldisc or tty_ldisc_release */
-                mutex_lock(&tty->ldisc_mutex);
-                tty_ldisc_halt(tty);
-                if (tty->ldisc) {       /* Not yet closed */
-                        /* Switch back to N_TTY */
-                        tty_ldisc_reinit(tty);
-                        /* At this point we have a closed ldisc and we want to
-                           reopen it. We could defer this to the next open but
-                           it means auditing a lot of other paths so this is
-                           a FIXME */
+        mutex_lock(&tty->ldisc_mutex);
+        tty_ldisc_halt(tty);
+        /* At this point we have a closed ldisc and we want to
+           reopen it. We could defer this to the next open but
+           it means auditing a lot of other paths so this is
+           a FIXME */
+        if (tty->ldisc) {       /* Not yet closed */
+                if (reset == 0) {
+                        tty_ldisc_reinit(tty, tty->termios->c_line);
+                        err = tty_ldisc_open(tty, tty->ldisc);
+                }
+                /* If the re-open fails or we reset then go to N_TTY. The
+                   N_TTY open cannot fail */
+                if (reset || err) {
+                        tty_ldisc_reinit(tty, N_TTY);
                         WARN_ON(tty_ldisc_open(tty, tty->ldisc));
-                        tty_ldisc_enable(tty);
                 }
-                mutex_unlock(&tty->ldisc_mutex);
-                tty_reset_termios(tty);
+                tty_ldisc_enable(tty);
         }
+        mutex_unlock(&tty->ldisc_mutex);
+        if (reset)
+                tty_reset_termios(tty);
 }
 
 /**