tty: Fix possible race in n_tty_read()

Fix possible panic caused by unlocked access to tty->read_cnt in
while-loop condition in n_tty_read().

Signed-off-by: Stanislav Kozina <skozina@redhat.com>
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index 101790cea4ae45622c0628bf1833012087f9c7c5..20de673a7730738cb1b8f2d8f74a2b72044c7a95 100644 (file)
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -1838,13 +1838,13 @@ do_it_again:
 
                if (tty->icanon && !L_EXTPROC(tty)) {
                        /* N.B. avoid overrun if nr == 0 */
+                       spin_lock_irqsave(&tty->read_lock, flags);
                        while (nr && tty->read_cnt) {
                                int eol;
 
                                eol = test_and_clear_bit(tty->read_tail,
                                                tty->read_flags);
                                c = tty->read_buf[tty->read_tail];
-                               spin_lock_irqsave(&tty->read_lock, flags);
                                tty->read_tail = ((tty->read_tail+1) &
                                                  (N_TTY_BUF_SIZE-1));
                                tty->read_cnt--;
@@ -1862,15 +1862,19 @@ do_it_again:
                                        if (tty_put_user(tty, c, b++)) {
                                                retval = -EFAULT;
                                                b--;
+                                               spin_lock_irqsave(&tty->read_lock, flags);
                                                break;
                                        }
                                        nr--;
                                }
                                if (eol) {
                                        tty_audit_push(tty);
+                                       spin_lock_irqsave(&tty->read_lock, flags);
                                        break;
                                }
+                               spin_lock_irqsave(&tty->read_lock, flags);
                        }
+                       spin_unlock_irqrestore(&tty->read_lock, flags);
                        if (retval)
                                break;
                } else {