[PATCH] tty_io: fix tiocswinsz, tiocgwinsz races.

[PATCH] tty_io: fix tiocswinsz, tiocgwinsz races.

[Kanru Chen]

real_tty may receive SIGWINCH before the new winsize is setted.

Signed-off-by: Kanru Chen <koster@debian.org.tw>
---
 drivers/char/tty_io.c |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)

diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index e1b46bc..63703ea 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -2523,6 +2523,8 @@ static int tiocswinsz(struct tty_struct *tty, struct tty_struct *real_tty,
 		return -EFAULT;
 
 	mutex_lock(&tty->termios_mutex);
+	if (real_tty != tty)
+		mutex_lock(&real_tty->termios_mutex);
 	if (!memcmp(&tmp_ws, &tty->winsize, sizeof(*arg)))
 		goto done;
 
@@ -2553,6 +2555,8 @@ static int tiocswinsz(struct tty_struct *tty, struct tty_struct *real_tty,
 	tty->winsize = tmp_ws;
 	real_tty->winsize = tmp_ws;
 done:
+	if (real_tty != tty)
+		mutex_unlock(&real_tty->termios_mutex);
 	mutex_unlock(&tty->termios_mutex);
 	return 0;
 }
-- 
1.5.6.3

Re: [PATCH] tty_io: fix tiocswinsz, tiocgwinsz races.

[Alan Cox]

On Fri,  8 Aug 2008 18:36:18 +0800
Kanru Chen <koster@debian.org.tw> wrote:

> real_tty may receive SIGWINCH before the new winsize is setted.

It needs rather more than that - for the moment I've gone back to the old
races because there is an awkward deadlock case to deal with. I've pushed
some changes to the -next tree to rework all this locking.

I had however missed the tty/real_tty case so something like your changes
might still be relevant. I'll take a look.