[PATCH] tty: discard flip-buffer input for TCSAFLUSH

[PATCH] tty: discard flip-buffer input for TCSAFLUSH

[Hungyu Lin]

set_termios() handles TERMIOS_FLUSH by clearing only the line discipline's
input buffer. Data already committed to the tty flip buffers can be
delivered after that flush, leaving old input readable after a successful
tcsetattr(TCSAFLUSH).

This can be reproduced with a raw PTY: complete an 8192-byte master write,
wait until the slave reports 4095 unread bytes, and apply TCSAFLUSH.
The remaining 4097 bytes are still readable afterwards. Small amounts of
pending input can also survive if they have not reached the line
discipline yet.

Use tty_buffer_flush() with the referenced line discipline to discard both
receive queues under the existing buffer lock. The helper checks for the
line discipline's flush_buffer callback itself.

Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
---
 drivers/tty/tty_ioctl.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/tty/tty_ioctl.c b/drivers/tty/tty_ioctl.c
index 90c70d8d14e3..45cb77185dbb 100644
--- a/drivers/tty/tty_ioctl.c
+++ b/drivers/tty/tty_ioctl.c
@@ -496,8 +496,8 @@ static int set_termios(struct tty_struct *tty, void __user *arg, int opt)
 
 		ld = tty_ldisc_ref(tty);
 		if (ld != NULL) {
-			if ((opt & TERMIOS_FLUSH) && ld->ops->flush_buffer)
-				ld->ops->flush_buffer(tty);
+			if (opt & TERMIOS_FLUSH)
+				tty_buffer_flush(tty, ld);
 			tty_ldisc_deref(ld);
 		}
 
-- 
2.43.0

Re: [PATCH] tty: discard flip-buffer input for TCSAFLUSH

[Greg KH]

On Tue, Oct 27, 2026 at 05:43:04AM +0000, Hungyu Lin wrote:
> set_termios() handles TERMIOS_FLUSH by clearing only the line discipline's
> input buffer. Data already committed to the tty flip buffers can be
> delivered after that flush, leaving old input readable after a successful
> tcsetattr(TCSAFLUSH).
> 
> This can be reproduced with a raw PTY: complete an 8192-byte master write,
> wait until the slave reports 4095 unread bytes, and apply TCSAFLUSH.
> The remaining 4097 bytes are still readable afterwards. Small amounts of
> pending input can also survive if they have not reached the line
> discipline yet.
> 
> Use tty_buffer_flush() with the referenced line discipline to discard both
> receive queues under the existing buffer lock. The helper checks for the
> line discipline's flush_buffer callback itself.
> 
> Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
> ---
>  drivers/tty/tty_ioctl.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/tty/tty_ioctl.c b/drivers/tty/tty_ioctl.c
> index 90c70d8d14e3..45cb77185dbb 100644
> --- a/drivers/tty/tty_ioctl.c
> +++ b/drivers/tty/tty_ioctl.c
> @@ -496,8 +496,8 @@ static int set_termios(struct tty_struct *tty, void __user *arg, int opt)
>  
>  		ld = tty_ldisc_ref(tty);
>  		if (ld != NULL) {
> -			if ((opt & TERMIOS_FLUSH) && ld->ops->flush_buffer)
> -				ld->ops->flush_buffer(tty);
> +			if (opt & TERMIOS_FLUSH)
> +				tty_buffer_flush(tty, ld);
>  			tty_ldisc_deref(ld);
>  		}
>  
> -- 
> 2.43.0
> 
> 

What commit id does this fix?  How was this tested?

thanks,

greg k-h

Re: [PATCH] tty: discard flip-buffer input for TCSAFLUSH

[Hungyu Lin]

> What commit id does this fix?  How was this tested?

The missing flip-buffer flush is already present in 1da177e4c3f4
(initial Git import). I could not identify its original introducing
commit.

Tested on ARM64 QEMU: an 8192-byte PTY write leaves 4097 stale bytes after
TCSAFLUSH before the fix, and none afterwards. Built the ARM64 Image and
32-bit x86 tty_ioctl.o with GCC 13.3.0, W=1.

I'll send v2 addressing the unthrottle issue.

Thanks,
Hungyu

Re: [PATCH] tty: discard flip-buffer input for TCSAFLUSH

[Greg KH]

On Tue, Oct 27, 2026 at 01:21:20AM -0700, Hungyu Lin wrote:
> > What commit id does this fix?  How was this tested?
> 
> The missing flip-buffer flush is already present in 1da177e4c3f4
> (initial Git import). I could not identify its original introducing
> commit.
> 
> Tested on ARM64 QEMU: an 8192-byte PTY write leaves 4097 stale bytes after
> TCSAFLUSH before the fix, and none afterwards. Built the ARM64 Image and
> 32-bit x86 tty_ioctl.o with GCC 13.3.0, W=1.

So as this is "just how things work" what is going to break with this
change?  Why change this at all at this point in time?  What needs this
fix?

And how was this found and tested?

thanks,

greg k-h