n_tty: Protect minimum_to_wake reset for concurrent readers

With multiple, concurrent readers (each waiting to acquire the
atomic_read_lock mutex), a departing reader may mistakenly reset
minimum_to_wake after a new reader has already set a new value.

Protect the minimum_to_wake reset with the atomic_read_lock critical
section.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index c222a56..0f74945 100644 (file)
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -2249,12 +2249,12 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,
        n_tty_set_room(tty);
        up_read(&tty->termios_rwsem);
 
-       mutex_unlock(&ldata->atomic_read_lock);
        remove_wait_queue(&tty->read_wait, &wait);
-
        if (!waitqueue_active(&tty->read_wait))
                ldata->minimum_to_wake = minimum;
 
+       mutex_unlock(&ldata->atomic_read_lock);
+
        __set_current_state(TASK_RUNNING);
        if (b - buf)
                retval = b - buf;