n_tty: Fix unsafe update of available buffer space
authorPeter Hurley <peter@hurleysoftware.com>
Sat, 15 Jun 2013 11:28:30 +0000 (07:28 -0400)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 17 Jun 2013 19:55:30 +0000 (12:55 -0700)
commitb84830527645dfe7b7a5cc03518e3c791b4ee9e0
treeece65ac8c7dd14703870d6417d99f7f856eac4e8
parenta6e54319a7499bf754efb3a2cb2f5d4901ccbcff
n_tty: Fix unsafe update of available buffer space

receive_room is used to control the amount of data the flip
buffer work can push to the read buffer. This update is unsafe:

  CPU 0                        |  CPU 1
                               |
                               | n_tty_read()
                               |   n_tty_set_room()
                               |     left = <calc of space>
n_tty_receive_buf()            |
  <push data to buffer>        |
  n_tty_set_room()             |
    left = <calc of space>     |
    tty->receive_room = left   |
                               |     tty->receive_room = left

receive_room is now updated with a stale calculation of the
available buffer space, and the subsequent work loop will likely
overwrite unread data in the input buffer.

Update receive_room atomically with the calculation of the
available buffer space.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/tty/n_tty.c