linux/drivers/tty
Peter Hurley fb5ef9e7da n_tty: Fix read buffer overwrite when no newline
In canon mode, the read buffer head will advance over the buffer tail
if the input > 4095 bytes without receiving a line termination char.

Discard additional input until a line termination is received.
Before evaluating for overflow, the 'room' value is normalized for
I_PARMRK and 1 byte is reserved for line termination (even in !icanon
mode, in case the mode is switched). The following table shows the
transform:

 actual buffer |  'room' value before overflow calc
  space avail  |    !I_PARMRK    |    I_PARMRK
 --------------------------------------------------
      0        |       -1        |       -1
      1        |        0        |        0
      2        |        1        |        0
      3        |        2        |        0
      4+       |        3        |        1

When !icanon or when icanon and the read buffer contains newlines,
normalized 'room' values of -1 and 0 are clamped to 0, and
'overflow' is 0, so read_head is not adjusted and the input i/o loop
exits (setting no_room if called from flush_to_ldisc()). No input
is discarded since the reader does have input available to read
which ensures forward progress.

When icanon and the read buffer does not contain newlines and the
normalized 'room' value is 0, then overflow and room are reset to 1,
so that the i/o loop will process the next input char normally
(except for parity errors which are ignored). Thus, erasures, signalling
chars, 7-bit mode, etc. will continue to be handled properly.

If the input char processed was not a line termination char, then
the canon_head index will not have advanced, so the normalized 'room'
value will now be -1 and 'overflow' will be set, which indicates the
read_head can safely be reset, effectively erasing the last char
processed.

If the input char processed was a line termination, then the
canon_head index will have advanced, so 'overflow' is cleared to 0,
the read_head is not reset, and 'room' is cleared to 0, which exits
the i/o loop (because the reader now have input available to read
which ensures forward progress).

Note that it is possible for a line termination to be received, and
for the reader to copy the line to the user buffer before the
input i/o loop is ready to process the next input char. This is
why the i/o loop recomputes the room/overflow state with every
input char while handling overflow.

Finally, if the input data was processed without receiving
a line termination (so that overflow is still set), the pty
driver must receive a write wakeup. A pty writer may be waiting
to write more data in n_tty_write() but without unthrottling
here that wakeup will not arrive, and forward progress will halt.
(Normally, the pty writer is woken when the reader reads data out
of the buffer and more space become available).

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-02-02 10:11:26 -08:00
..
hvc Driver core patches for 3.19-rc1 2014-12-14 16:10:09 -08:00
ipwireless tty: ipwireless: Fix probable mask then right shift defects 2014-11-05 20:06:33 -08:00
serial serial: samsung: Add support for early console 2015-02-02 10:11:26 -08:00
vt vt: provide notifications on selection changes 2015-02-02 10:09:54 -08:00
amiserial.c TTY: fix misspelling of current function in string 2015-01-09 14:38:15 -08:00
bfin_jtag_comm.c sched, cleanup, treewide: Remove set_current_state(TASK_RUNNING) after schedule() 2014-09-19 12:35:17 +02:00
cyclades.c tty: Remove tty_hung_up_p() tests from tty drivers' open() 2014-07-10 16:06:49 -07:00
ehv_bytechan.c Driver core patches for 3.19-rc1 2014-12-14 16:10:09 -08:00
goldfish.c goldfish: off by one in goldfish_tty_console_setup() 2014-11-05 16:12:45 -08:00
isicom.c tty/isicom: fix big-endian compile warning 2015-02-02 10:11:25 -08:00
Kconfig
Makefile
metag_da.c tty/metag_da: Add console_poll module parameter 2014-09-28 21:35:56 -04:00
moxa.c TTY: fix decimal printf format specifiers prefixed with 0x 2014-09-08 15:51:35 -07:00
moxa.h
mxser.c
mxser.h
n_gsm.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2014-08-06 09:38:14 -07:00
n_hdlc.c drivers/tty/n_hdlc.c: replace kmalloc/memset by kzalloc 2014-05-28 13:33:18 -07:00
n_r3964.c
n_tracerouter.c
n_tracesink.c
n_tracesink.h
n_tty.c n_tty: Fix read buffer overwrite when no newline 2015-02-02 10:11:26 -08:00
nozomi.c drivers/tty/nozomi.c: Use 'nozomi_setup_memory' instead of 'setup_memory' 2014-09-08 16:09:23 -07:00
pty.c pty: Fix overlimit memory use 2015-02-02 10:11:25 -08:00
rocket_int.h
rocket.c TTY: fix misspelling of current function in string 2015-01-09 14:38:15 -08:00
rocket.h
synclink_gt.c synclink_gt: use pci_zalloc_consistent 2014-08-08 15:57:30 -07:00
synclink.c tty: Remove tty_hung_up_p() tests from tty drivers' open() 2014-07-10 16:06:49 -07:00
synclinkmp.c tty: Remove tty_hung_up_p() tests from tty drivers' open() 2014-07-10 16:06:49 -07:00
sysrq.c mm, oom: ensure memoryless node zonelist always includes zones 2014-08-06 18:01:21 -07:00
tty_audit.c audit: anchor all pid references in the initial pid namespace 2014-03-20 10:11:55 -04:00
tty_buffer.c tty: Flush ldisc buffer atomically with tty flip buffers 2014-11-05 18:50:43 -08:00
tty_io.c tty: Prevent hw state corruption in exclusive mode reopen 2015-01-09 13:46:02 -08:00
tty_ioctl.c tty: Call methods in modern style 2014-11-05 20:18:30 -08:00
tty_ldisc.c tty: Allow safe access to termios for set_ldisc() handlers 2014-11-06 14:57:27 -08:00
tty_ldsem.c lockdep: Make held_lock->check and "int check" argument bool 2014-02-09 21:18:54 +01:00
tty_mutex.c tty: Remove warning in tty_lock_slave() 2015-01-09 14:17:59 -08:00
tty_port.c tty: Deletion of unnecessary checks before two function calls 2014-11-26 19:35:49 -08:00