The patch titled
tty locking on resize
has been removed from the -mm tree. Its filename is
tty-locking-on-resize.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
Subject: tty locking on resize
From: Alan Cox <alan@xxxxxxxxxxxxxxxxxxx>
The current kernel serializes console resizes but does not serialize the
resize against the tty structure updates. This means that while two
parallel resizes cannot mess up the console you can get incorrect results
reported.
Secondly while doing this I added vc_lock_resize() to lock and resize the
console. This leaves all knowledge of the console_sem in the vt/console
driver and kicks it out of the tty layer, which is good
Thirdly while doing this I decided I couldn't stand "disallocate" any
longer so I switched it to "deallocate".
Signed-off-by: Alan Cox <alan@xxxxxxxxxx>
Cc: Paul Fulghum <paulkf@xxxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxx>
---
drivers/char/selection.c | 2 +-
drivers/char/tty_io.c | 29 +++++++++++++++--------------
drivers/char/vt.c | 12 +++++++++++-
drivers/char/vt_ioctl.c | 17 +++++++----------
include/linux/vt_kern.h | 3 ++-
5 files changed, 36 insertions(+), 27 deletions(-)
diff -puN drivers/char/selection.c~tty-locking-on-resize drivers/char/selection.c
--- a/drivers/char/selection.c~tty-locking-on-resize
+++ a/drivers/char/selection.c
@@ -33,7 +33,7 @@ extern void poke_blanked_console(void);
/* Variables for selection control. */
/* Use a dynamic buffer, instead of static (Dec 1994) */
-struct vc_data *sel_cons; /* must not be disallocated */
+struct vc_data *sel_cons; /* must not be deallocated */
static volatile int sel_start = -1; /* cleared by clear_selection */
static int sel_end;
static int sel_buffer_lth;
diff -puN drivers/char/tty_io.c~tty-locking-on-resize drivers/char/tty_io.c
--- a/drivers/char/tty_io.c~tty-locking-on-resize
+++ a/drivers/char/tty_io.c
@@ -2770,12 +2770,11 @@ static int tiocgwinsz(struct tty_struct
* actually has driver level meaning and triggers a VC resize.
*
* Locking:
- * The console_sem is used to ensure we do not try and resize
- * the console twice at once.
- * FIXME: Two racing size sets may leave the console and kernel
- * parameters disagreeing. Is this exploitable ?
- * FIXME: Random values racing a window size get is wrong
- * should lock here against that
+ * Called function use the console_sem is used to ensure we do
+ * not try and resize the console twice at once.
+ * The tty->termios_sem is used to ensure we don't double
+ * resize and get confused. Lock order - tty->termios.sem before
+ * console sem
*/
static int tiocswinsz(struct tty_struct *tty, struct tty_struct *real_tty,
@@ -2785,17 +2784,17 @@ static int tiocswinsz(struct tty_struct
if (copy_from_user(&tmp_ws, arg, sizeof(*arg)))
return -EFAULT;
+
+ down(&tty->termios_sem);
if (!memcmp(&tmp_ws, &tty->winsize, sizeof(*arg)))
- return 0;
+ goto done;
+
#ifdef CONFIG_VT
if (tty->driver->type == TTY_DRIVER_TYPE_CONSOLE) {
- int rc;
-
- acquire_console_sem();
- rc = vc_resize(tty->driver_data, tmp_ws.ws_col, tmp_ws.ws_row);
- release_console_sem();
- if (rc)
- return -ENXIO;
+ if (vc_lock_resize(tty->driver_data, tmp_ws.ws_col, tmp_ws.ws_row)) {
+ up(&tty->termios_sem);
+ return -ENXIO;
+ }
}
#endif
if (tty->pgrp > 0)
@@ -2804,6 +2803,8 @@ static int tiocswinsz(struct tty_struct
kill_pg(real_tty->pgrp, SIGWINCH, 1);
tty->winsize = tmp_ws;
real_tty->winsize = tmp_ws;
+done:
+ up(&tty->termios_sem);
return 0;
}
diff -puN drivers/char/vt.c~tty-locking-on-resize drivers/char/vt.c
--- a/drivers/char/vt.c~tty-locking-on-resize
+++ a/drivers/char/vt.c
@@ -885,8 +885,17 @@ int vc_resize(struct vc_data *vc, unsign
return err;
}
+int vc_lock_resize(struct vc_data *vc, unsigned int cols, unsigned int lines)
+{
+ int rc;
+
+ acquire_console_sem();
+ rc = vc_resize(vc, cols, lines);
+ release_console_sem();
+ return rc;
+}
-void vc_disallocate(unsigned int currcons)
+void vc_deallocate(unsigned int currcons)
{
WARN_CONSOLE_UNLOCKED();
@@ -3790,6 +3799,7 @@ EXPORT_SYMBOL(default_blu);
EXPORT_SYMBOL(update_region);
EXPORT_SYMBOL(redraw_screen);
EXPORT_SYMBOL(vc_resize);
+EXPORT_SYMBOL(vc_lock_resize);
EXPORT_SYMBOL(fg_console);
EXPORT_SYMBOL(console_blank_hook);
EXPORT_SYMBOL(console_blanked);
diff -puN drivers/char/vt_ioctl.c~tty-locking-on-resize drivers/char/vt_ioctl.c
--- a/drivers/char/vt_ioctl.c~tty-locking-on-resize
+++ a/drivers/char/vt_ioctl.c
@@ -96,7 +96,7 @@ do_kdsk_ioctl(int cmd, struct kbentry __
if (!perm)
return -EPERM;
if (!i && v == K_NOSUCHMAP) {
- /* disallocate map */
+ /* deallocate map */
key_map = key_maps[s];
if (s && key_map) {
key_maps[s] = NULL;
@@ -819,20 +819,20 @@ int vt_ioctl(struct tty_struct *tty, str
if (arg > MAX_NR_CONSOLES)
return -ENXIO;
if (arg == 0) {
- /* disallocate all unused consoles, but leave 0 */
+ /* deallocate all unused consoles, but leave 0 */
acquire_console_sem();
for (i=1; i<MAX_NR_CONSOLES; i++)
if (! VT_BUSY(i))
- vc_disallocate(i);
+ vc_deallocate(i);
release_console_sem();
} else {
- /* disallocate a single console, if possible */
+ /* deallocate a single console, if possible */
arg--;
if (VT_BUSY(arg))
return -EBUSY;
if (arg) { /* leave 0 */
acquire_console_sem();
- vc_disallocate(arg);
+ vc_deallocate(arg);
release_console_sem();
}
}
@@ -847,11 +847,8 @@ int vt_ioctl(struct tty_struct *tty, str
if (get_user(ll, &vtsizes->v_rows) ||
get_user(cc, &vtsizes->v_cols))
return -EFAULT;
- for (i = 0; i < MAX_NR_CONSOLES; i++) {
- acquire_console_sem();
- vc_resize(vc_cons[i].d, cc, ll);
- release_console_sem();
- }
+ for (i = 0; i < MAX_NR_CONSOLES; i++)
+ vc_lock_resize(vc_cons[i].d, cc, ll);
return 0;
}
diff -puN include/linux/vt_kern.h~tty-locking-on-resize include/linux/vt_kern.h
--- a/include/linux/vt_kern.h~tty-locking-on-resize
+++ a/include/linux/vt_kern.h
@@ -33,7 +33,8 @@ extern int fg_console, last_console, wan
int vc_allocate(unsigned int console);
int vc_cons_allocated(unsigned int console);
int vc_resize(struct vc_data *vc, unsigned int cols, unsigned int lines);
-void vc_disallocate(unsigned int console);
+int vc_lock_resize(struct vc_data *vc, unsigned int cols, unsigned int lines);
+void vc_deallocate(unsigned int console);
void reset_palette(struct vc_data *vc);
void do_blank_screen(int entering_gfx);
void do_unblank_screen(int leaving_gfx);
_
Patches currently in -mm which might be from alan@xxxxxxxxxxxxxxxxxxx are
origin.patch
git-agpgart.patch
fix-gregkh-driver-nozomi.patch
git-dvb.patch
libata-add-40pin-short-cable-support-honour-drive.patch
via-pata-controller-xfer-fixes.patch
edac-new-opteron-athlon64-memory-controller-driver.patch
edac-new-opteron-athlon64-memory-controller-driver-tidy.patch
ahci-ati-sb600-sata-support-for-various-modes.patch
serial-fix-up-offenders-peering-at-baud-bits-directly.patch
pci-via82cxxx_audio-use-pci_get_device.patch
pci-cs46xx-oss-switch-to-pci_get_device.patch
pci-piix-use-refcounted-interface-when-searching-for-a-450nx.patch
pci-serverworks-switch-to-pci-refcounted-interfaces.patch
pci-sis5513-switch-to-pci-refcounting.patch
pci-via-switch-to-pci_get_device-refcounted-pci-api.patch
ip2-use-newer-pci_get-functions.patch
i2o-switch-to-pci_get-api.patch
cardbus-switch-to-ref-counting-hotplug-safe-api.patch
char-specialix-kill-unneeded-page-alloc.patch
ioremap-balanced-with-iounmap-for-drivers-serial-8250_acorn.patch
ioremap-balanced-with-iounmap-for-drivers-serial-8250_gsc.patch
ioremap-balanced-with-iounmap-for-drivers-serial-ioc4_serial.patch
ioremap-balanced-with-iounmap-for-drivers-serial-ip22zilog.patch
ioremap-balanced-with-iounmap-for-drivers-serial-mpc52xx_uart.patch
ioremap-balanced-with-iounmap-for-drivers-serial-mpsc.patch
ioremap-balanced-with-iounmap-for-drivers-serial-mux.patch
ioremap-balanced-with-iounmap-for-drivers-serial-sunsu.patch
support-piping-into-commands-in-proc-sys-kernel-core_pattern.patch
support-piping-into-commands-in-proc-sys-kernel-core_pattern-fix-2.patch
pci-mxser-pci-refcounts.patch
mxser-make-an-experimental-clone.patch
char-mxser_new-correct-include-file.patch
char-mxser_new-upgrade-to-191.patch
char-mxser_new-rework-to-allow-dynamic-structs.patch
non-libata-driver-for-jmicron-devices.patch
ide-claim-extra-dma-ports-regardless-of-channel.patch
ide-always-release-dma-engine.patch
ide-error-handling-fixes.patch
ide-hpt3xxn-clocking-fixes.patch
ide-fix-hpt37x-timing-tables.patch
ide-optimize-hpt37x-timing-tables.patch
ide-fix-hpt3xx-hotswap-support.patch
ide-fix-the-case-of-multiple-hpt3xx-chips-present.patch
ide-hpt3xx-fix-pci-clock-detection.patch
ide-hpt3xx-fix-pci-clock-detection-fix-2.patch
piix-fix-82371mx-enablebits.patch
piix-remove-check-for-broken-mw-dma-mode-0.patch
piix-slc90e66-pio-mode-fallback-fix.patch
make-number-of-ide-interfaces-configurable.patch
ide_dma_speed-fixes.patch
hpt3xx-rework-rate-filtering.patch
hpt3xx-rework-rate-filtering-tidy.patch
hpt3xx-print-the-real-chip-name-at-startup.patch
hpt3xx-switch-to-using-pci_get_slot.patch
hpt3xx-cache-channels-mcr-address.patch
hpt3x7-merge-speedproc-handlers.patch
hpt370-clean-up-dma-timeout-handling.patch
enable-cdrom-dma-access-with-pdc20265_old.patch
ide-fix-revision-comparison-in-ide_in_drive_list.patch
ide-backport-piix-fixes-from-libata-into-the-legacy-driver.patch
hpt3xx-init-code-rewrite.patch
move-ide-to-unmaintained-drop-reference-to-old-git-tree.patch
drivers-ide-cleanups.patch
ide-remove-dma_base2-field-from-ide_hwif_t.patch
ide-reprogram-disk-pio-timings-on-resume.patch
config_pm=n-slim-drivers-ide-pci-sc1200c.patch
ide-fix-crash-on-repeated-reset.patch
ide-fix-crash-on-repeated-reset-tidy.patch
sstfb-clean-ups.patch
pci_module_init-convertion-in-ata_genericc.patch
pci_module_init-convertion-in-ata_genericc-fix.patch
-
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
