tty: Drop tty_mutex before tty reopen

Holding tty_mutex for a tty re-open is no longer necessary since
"tty: Clarify re-open behavior of master ptys". Because the
slave tty count is no longer accessed by tty_reopen(), holding
tty_mutex to prevent concurrent final tty_release() of the slave
pty is not required.

As with "tty: Re-open /dev/tty without tty_mutex", holding a
tty kref until the tty_lock is acquired is sufficient to ensure
the tty has not been freed, which, in turn, is sufficient to
ensure the tty_lock can be safely acquired and the tty count
can be safely retrieved. A non-zero tty count with the tty lock
held guarantees that release_tty() has not run and cannot
run concurrently with tty_reopen().

Change tty_driver_lookup_tty() to acquire the tty kref, which
allows the tty_mutex to be dropped before acquiring the tty lock.
Dropping the tty_mutex before attempting the tty_lock allows
other ttys to be opened and released, without needing this
tty_reopen() to complete.

Reviewed-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 2e166a1be2b7ef9199be9aee8a42400405133caa..66d6bcc24c7e38d853a1cb583a930c89d9f8c432 100644 (file)
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -1344,19 +1344,24 @@ static ssize_t tty_line_name(struct tty_driver *driver, int index, char *p)
  *     @driver: the driver for the tty
  *     @idx:    the minor number
  *
- *     Return the tty, if found or ERR_PTR() otherwise.
+ *     Return the tty, if found. If not found, return NULL or ERR_PTR() if the
+ *     driver lookup() method returns an error.
  *
- *     Locking: tty_mutex must be held. If tty is found, the mutex must
- *     be held until the 'fast-open' is also done. Will change once we
- *     have refcounting in the driver and per driver locking
+ *     Locking: tty_mutex must be held. If the tty is found, bump the tty kref.
  */
 static struct tty_struct *tty_driver_lookup_tty(struct tty_driver *driver,
                struct inode *inode, int idx)
 {
+       struct tty_struct *tty;
+
        if (driver->ops->lookup)
-               return driver->ops->lookup(driver, inode, idx);
+               tty = driver->ops->lookup(driver, inode, idx);
+       else
+               tty = driver->ttys[idx];
 
-       return driver->ttys[idx];
+       if (!IS_ERR(tty))
+               tty_kref_get(tty);
+       return tty;
 }
 
 /**
@@ -2081,16 +2086,20 @@ retry_open:
                }
 
                if (tty) {
+                       mutex_unlock(&tty_mutex);
                        tty_lock(tty);
+                       /* safe to drop the kref from tty_driver_lookup_tty() */
+                       tty_kref_put(tty);
                        retval = tty_reopen(tty);
                        if (retval < 0) {
                                tty_unlock(tty);
                                tty = ERR_PTR(retval);
                        }
-               } else  /* Returns with the tty_lock held for now */
+               } else { /* Returns with the tty_lock held for now */
                        tty = tty_init_dev(driver, index);
+                       mutex_unlock(&tty_mutex);
+               }
 
-               mutex_unlock(&tty_mutex);
                tty_driver_kref_put(driver);
        }