tty: hold lock across tty buffer finding and buffer filling

BZ:27313

tty_buffer_request_room is well protected, but while after it returns,
it releases the port->lock. tty->buf.tail might be modified
by either irq handler or other threads. The patch adds more protection
by holding the lock across tty buffer finding and buffer filling.
Signed-off-by: Xiaobing Tu <xiaobing.tu@intel.com>
Change-Id: Iffbfc2d7e6400807abe6d791e5f8a48e150be5e4
Reviewed-on: http://android.intel.com:8080/38961
Reviewed-by: Tu, Xiaobing <xiaobing.tu@intel.com>
Reviewed-by: Yang, Fei <fei.yang@intel.com>
Reviewed-by: Mansoor, Illyas <illyas.mansoor@intel.com>
Reviewed-by: Koskinen, Ilkka <ilkka.koskinen@intel.com>
Tested-by: Ng, Cheon-woei <cheon-woei.ng@intel.com>
Reviewed-by: buildbot <buildbot@intel.com>
Tested-by: buildbot <buildbot@intel.com>

diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c
index c562354..ff4be74 100644 (file)
--- a/drivers/tty/tty_buffer.c
+++ b/drivers/tty/tty_buffer.c
@@ -187,23 +187,18 @@ static struct tty_buffer *tty_buffer_find(struct tty_struct *tty, size_t size)
 }
 
 /**
- *     tty_buffer_request_room         -       grow tty buffer if needed
+ *     __tty_buffer_request_room               -       grow tty buffer if needed
  *     @tty: tty structure
  *     @size: size desired
  *
  *     Make at least size bytes of linear space available for the tty
  *     buffer. If we fail return the size we managed to find.
- *
- *     Locking: Takes tty->buf.lock
+ *      Locking: Caller must hold tty->buf.lock
  */
-int tty_buffer_request_room(struct tty_struct *tty, size_t size)
+static int __tty_buffer_request_room(struct tty_struct *tty, size_t size)
 {
        struct tty_buffer *b, *n;
        int left;
-       unsigned long flags;
-
-       spin_lock_irqsave(&tty->buf.lock, flags);
-
        /* OPTIMISATION: We could keep a per tty "zero" sized buffer to
           remove this conditional if its worth it. This would be invisible
           to the callers */
@@ -225,11 +220,32 @@ int tty_buffer_request_room(struct tty_struct *tty, size_t size)
                        size = left;
        }
 
-       spin_unlock_irqrestore(&tty->buf.lock, flags);
        return size;
 }
+
+
+/**
+ *     tty_buffer_request_room         -       grow tty buffer if needed
+ *     @tty: tty structure
+ *     @size: size desired
+ *
+ *     Make at least size bytes of linear space available for the tty
+ *     buffer. If we fail return the size we managed to find.
+ *
+ *     Locking: Takes tty->buf.lock
+ */
+int tty_buffer_request_room(struct tty_struct *tty, size_t size)
+{
+       unsigned long flags;
+       int length;
+       spin_lock_irqsave(&tty->buf.lock, flags);
+       length = __tty_buffer_request_room(tty, size);
+       spin_unlock_irqrestore(&tty->buf.lock, flags);
+       return length;
+}
 EXPORT_SYMBOL_GPL(tty_buffer_request_room);
 
+
 /**
  *     tty_insert_flip_string_fixed_flag - Add characters to the tty buffer
  *     @tty: tty structure
@@ -249,19 +265,18 @@ int tty_insert_flip_string_fixed_flag(struct tty_struct *tty,
        int copied = 0;
        do {
                int goal = min_t(size_t, size - copied, TTY_BUFFER_PAGE);
-               int space = tty_buffer_request_room(tty, goal);
                unsigned long flags;
                struct tty_buffer *tb;
-               /* If there is no space then tb may be NULL */
-               if (unlikely(space == 0))
-                       break;
+               int space;
+
                spin_lock_irqsave(&tty->buf.lock, flags);
-               tb = tty->buf.tail;
-               /* check tb again since the buf.tail may be updated */
-               if (unlikely(tb == NULL)) {
+               space = __tty_buffer_request_room(tty, goal);
+               /* If there is no space then tb may be NULL */
+               if (unlikely(space == 0)) {
                        spin_unlock_irqrestore(&tty->buf.lock, flags);
                        break;
                }
+               tb = tty->buf.tail;
                memcpy(tb->char_buf_ptr + tb->used, chars, space);
                memset(tb->flag_buf_ptr + tb->used, flag, space);
                tb->used += space;
@@ -295,19 +310,18 @@ int tty_insert_flip_string_flags(struct tty_struct *tty,
        int copied = 0;
        do {
                int goal = min_t(size_t, size - copied, TTY_BUFFER_PAGE);
-               int space = tty_buffer_request_room(tty, goal);
+               int space;
                unsigned long __flags;
                struct tty_buffer *tb;
-               /* If there is no space then tb may be NULL */
-               if (unlikely(space == 0))
-                       break;
+
                spin_lock_irqsave(&tty->buf.lock, __flags);
-               tb = tty->buf.tail;
-               /* check tb again since the buf.tail may be updated */
-               if (unlikely(tb == NULL)) {
+               space = __tty_buffer_request_room(tty, goal);
+               /* If there is no space then tb may be NULL */
+               if (unlikely(space == 0)) {
                        spin_unlock_irqrestore(&tty->buf.lock, __flags);
                        break;
                }
+               tb = tty->buf.tail;
                memcpy(tb->char_buf_ptr + tb->used, chars, space);
                memcpy(tb->flag_buf_ptr + tb->used, flags, space);
                tb->used += space;
@@ -362,13 +376,14 @@ EXPORT_SYMBOL(tty_schedule_flip);
 int tty_prepare_flip_string(struct tty_struct *tty, unsigned char **chars,
                                                                size_t size)
 {
-       int space = tty_buffer_request_room(tty, size);
+       int space;
        unsigned long flags;
        struct tty_buffer *tb;
 
        spin_lock_irqsave(&tty->buf.lock, flags);
+       space = __tty_buffer_request_room(tty, size);
        tb = tty->buf.tail;
-       if (likely(space) && likely(tb)) {
+       if (likely(space)) {
                *chars = tb->char_buf_ptr + tb->used;
                memset(tb->flag_buf_ptr + tb->used, TTY_NORMAL, space);
                tb->used += space;
@@ -397,13 +412,14 @@ EXPORT_SYMBOL_GPL(tty_prepare_flip_string);
 int tty_prepare_flip_string_flags(struct tty_struct *tty,
                        unsigned char **chars, char **flags, size_t size)
 {
-       int space = tty_buffer_request_room(tty, size);
+       int space;
        unsigned long __flags;
        struct tty_buffer *tb;
 
        spin_lock_irqsave(&tty->buf.lock, __flags);
+       space = __tty_buffer_request_room(tty, size);
        tb = tty->buf.tail;
-       if (likely(space) && likely(tb)) {
+       if (likely(space)) {
                *chars = tb->char_buf_ptr + tb->used;
                *flags = tb->flag_buf_ptr + tb->used;
                tb->used += space;