[PATCH] speakup: don't use the ldisc data after a hangup

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

From: Josef Bacik <josef@toxicpanda.com>

ttyio_in() takes the struct spk_ldisc_data from tty->disc_data and waits
for its completion. The structure belongs to the line discipline:
spk_ttyio_ldisc_close() frees it, and leaves the pointer in place.

speakup holds the tty until the synthesizer is released, but the line
discipline can be closed before that. A hangup of the port does it:
__tty_hangup() calls tty_ldisc_hangup(), and as no file is open for the
tty, this one calls tty_ldisc_kill(). The port is hung up when a USB
serial adapter is pulled out, and when a serial port for which CLOCAL was
switched off loses the carrier.

After that every call of ttyio_in() takes the lock of a completion in
freed memory and may write to it. The LiteTalk and Speakout drivers call
it through spk_synth_get_index() whenever "read all" is used. If the
hangup comes while ttyio_in() sleeps, the completion is freed under it.

Take a reference to the line discipline for the time the data is used,
and report that there is no input if there is none any more.
tty_ldisc_ref() does not sleep, so it can be used by the callers in
atomic context, too. Also clear the pointer when the data is freed.

Fixes: 6b9ad1c742bf ("staging: speakup: add send_xchar, tiocmset and input functionality for tty")
Cc: stable <stable@kernel.org>
Cc: William Hubbs <w.d.hubbs@gmail.com>
Cc: Chris Brannon <chris@the-brannons.com>
Cc: Kirk Reiser <kirk@reisers.ca>
Cc: Samuel Thibault <samuel.thibault@ens-lyon.org>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/accessibility/speakup/spk_ttyio.c | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/drivers/accessibility/speakup/spk_ttyio.c b/drivers/accessibility/speakup/spk_ttyio.c
index 6bff78e3d872..44139d870ac4 100644
--- a/drivers/accessibility/speakup/spk_ttyio.c
+++ b/drivers/accessibility/speakup/spk_ttyio.c
@@ -69,6 +69,7 @@ static int spk_ttyio_ldisc_open(struct tty_struct *tty)
 static void spk_ttyio_ldisc_close(struct tty_struct *tty)
 {
 	kfree(tty->disc_data);
+	tty->disc_data = NULL;
 }
 
 static size_t spk_ttyio_receive_buf2(struct tty_struct *tty, const u8 *cp,
@@ -291,17 +292,24 @@ static int spk_ttyio_wait_for_xmitr(struct spk_synth *in_synth)
 static unsigned char ttyio_in(struct spk_synth *in_synth, int timeout)
 {
 	struct tty_struct *tty = in_synth->dev;
-	struct spk_ldisc_data *ldisc_data = tty->disc_data;
-	char rv;
+	struct spk_ldisc_data *ldisc_data;
+	struct tty_ldisc *ld;
+	char rv = 0xff;
+
+	/* A hangup of the port closes the line discipline, which frees its data. */
+	ld = tty_ldisc_ref(tty);
+	if (!ld)
+		return 0xff;
+	ldisc_data = tty->disc_data;
 
 	if (!timeout) {
 		if (!try_wait_for_completion(&ldisc_data->completion))
-			return 0xff;
+			goto out;
 	} else if (wait_for_completion_timeout(&ldisc_data->completion,
 					usecs_to_jiffies(timeout)) == 0) {
 		pr_warn("spk_ttyio: timeout (%d)  while waiting for input\n",
 			timeout);
-		return 0xff;
+		goto out;
 	}
 
 	rv = ldisc_data->buf;
@@ -312,6 +320,8 @@ static unsigned char ttyio_in(struct spk_synth *in_synth, int timeout)
 	ldisc_data->buf_free = true;
 	/* Let TTY push more characters */
 	tty_flip_buffer_push(tty->port);
+out:
+	tty_ldisc_deref(ld);
 
 	return rv;
 }
-- 
2.56.0