tty: Correct tty buffer flush.

commit 64325a3be08d364a62ee8f84b2cf86934bc2544a upstream.

  The root of problem is carelessly zeroing pointer(in function __tty_buffer_flush()),
when another thread can use it. It can be cause of "NULL pointer dereference".
  Main idea of the patch, this is never free last (struct tty_buffer) in the active buffer.
Only flush the data for ldisc(buf->head->read = buf->head->commit).
At that moment driver can collect(write) data in buffer without conflict.
It is repeat behavior of flush_to_ldisc(), only without feeding data to ldisc.

Signed-off-by: Ilya Zykov <ilya@ilyx.ru>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c
index 6c9b7cd6778a9613542d739358f309a38fa56070..4f02f9ce05c5862a0389325b8f460343f69b3c7f 100644 (file)
--- a/drivers/tty/tty_buffer.c
+++ b/drivers/tty/tty_buffer.c
@@ -114,11 +114,14 @@ static void __tty_buffer_flush(struct tty_struct *tty)
 {
        struct tty_buffer *thead;
 
-       while ((thead = tty->buf.head) != NULL) {
-               tty->buf.head = thead->next;
-               tty_buffer_free(tty, thead);
+       if (tty->buf.head == NULL)
+               return;
+       while ((thead = tty->buf.head->next) != NULL) {
+               tty_buffer_free(tty, tty->buf.head);
+               tty->buf.head = thead;
        }
-       tty->buf.tail = NULL;
+       WARN_ON(tty->buf.head != tty->buf.tail);
+       tty->buf.head->read = tty->buf.head->commit;
 }
 
 /**