From: Alan Cox If your driver implements "break on" and "break off" this ensures you won't get multiple overlapping requests or requests in parallel. If your driver has its own break handling then its still your problem as the driver author. Break is also now serialized against writes from user space properly but no new guarantees are made driver level about writes from the line discipline itself (eg flow control or echo) Signed-off-by: Alan Cox Signed-off-by: Andrew Morton --- drivers/char/tty_io.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff -puN drivers/char/tty_io.c~tty-fix-bits-and-note-more-bits-to-fix drivers/char/tty_io.c --- a/drivers/char/tty_io.c~tty-fix-bits-and-note-more-bits-to-fix +++ a/drivers/char/tty_io.c @@ -2718,6 +2718,8 @@ static int tty_fasync(int fd, struct fil * Locking: * Called functions take tty_ldisc_lock * current->signal->tty check is safe without locks + * + * FIXME: may race normal receive processing */ static int tiocsti(struct tty_struct *tty, char __user *p) @@ -2877,9 +2879,7 @@ static int fionbio(struct file *file, in * Locking: * Takes tasklist lock internally to walk sessions * Takes task_lock() when updating signal->tty - * - * FIXME: tty_mutex is needed to protect signal->tty references. - * FIXME: why task_lock on the signal->tty reference ?? + * Takes tty_mutex() to protect tty instance * */ @@ -2914,9 +2914,11 @@ static int tiocsctty(struct tty_struct * } else return -EPERM; } + mutex_lock(&tty_mutex); task_lock(current); current->signal->tty = tty; task_unlock(current); + mutex_unlock(&tty_mutex); current->signal->tty_old_pgrp = 0; tty->session = current->signal->session; tty->pgrp = process_group(current); @@ -2956,8 +2958,6 @@ static int tiocgpgrp(struct tty_struct * * permitted where the tty session is our session. * * Locking: None - * - * FIXME: current->signal->tty referencing is unsafe. */ static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p) @@ -3036,19 +3036,20 @@ static int tiocsetd(struct tty_struct *t * timed break functionality. * * Locking: - * None + * atomic_write_lock serializes * - * FIXME: - * What if two overlap */ static int send_break(struct tty_struct *tty, unsigned int duration) { + if (mutex_lock_interruptible(&tty->atomic_write_lock)) + return -EINTR; tty->driver->break_ctl(tty, -1); if (!signal_pending(current)) { msleep_interruptible(duration); } tty->driver->break_ctl(tty, 0); + mutex_unlock(&tty->atomic_write_lock); if (signal_pending(current)) return -EINTR; return 0; @@ -3141,6 +3142,8 @@ int tty_ioctl(struct inode * inode, stru if (tty_paranoia_check(tty, inode, "tty_ioctl")) return -EINVAL; + /* CHECKME: is this safe as one end closes ? */ + real_tty = tty; if (tty->driver->type == TTY_DRIVER_TYPE_PTY && tty->driver->subtype == PTY_TYPE_MASTER) _