Skip to content

Commit d97aa06

Browse files
Jiri Slaby (SUSE)gregkh
authored andcommitted
tty: n_tty: use uint for space returned by tty_write_room()
tty_write_room() returns an "unsigned int". So in case some insane driver (like my tty test driver) returns (legitimate) UINT_MAX from its tty_operations::write_room(), n_tty is confused on several places. For example, in process_output_block(), the result of tty_write_room() is stored into (signed) "int". So this UINT_MAX suddenly becomes -1. And that is extended to ssize_t and returned from process_output_block(). This causes a write() to such a node to receive -EPERM (which is -1). Fix that by using proper "unsigned int" and proper "== 0" test. And return 0 constant directly in that "if", so that it is immediately clear what is returned ("space" equals to 0 at that point). Similarly for process_output() and __process_echoes(). Note this does not fix any in-tree driver as of now. If you want "Fixes: something", it would be commit 03b3b1a ("tty: make tty_operations::write_room return uint"). I intentionally do not mark this patch by a real tag below. Signed-off-by: Jiri Slaby (SUSE) <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
1 parent d2e38e7 commit d97aa06

File tree

1 file changed

+7
-6
lines changed

1 file changed

+7
-6
lines changed

drivers/tty/n_tty.c

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -488,7 +488,8 @@ static int do_output_char(u8 c, struct tty_struct *tty, int space)
488488
static int process_output(u8 c, struct tty_struct *tty)
489489
{
490490
struct n_tty_data *ldata = tty->disc_data;
491-
int space, retval;
491+
unsigned int space;
492+
int retval;
492493

493494
mutex_lock(&ldata->output_lock);
494495

@@ -524,16 +525,16 @@ static ssize_t process_output_block(struct tty_struct *tty,
524525
const u8 *buf, unsigned int nr)
525526
{
526527
struct n_tty_data *ldata = tty->disc_data;
527-
int space;
528-
int i;
528+
unsigned int space;
529+
int i;
529530
const u8 *cp;
530531

531532
mutex_lock(&ldata->output_lock);
532533

533534
space = tty_write_room(tty);
534-
if (space <= 0) {
535+
if (space == 0) {
535536
mutex_unlock(&ldata->output_lock);
536-
return space;
537+
return 0;
537538
}
538539
if (nr > space)
539540
nr = space;
@@ -698,7 +699,7 @@ static int n_tty_process_echo_ops(struct tty_struct *tty, size_t *tail,
698699
static size_t __process_echoes(struct tty_struct *tty)
699700
{
700701
struct n_tty_data *ldata = tty->disc_data;
701-
int space, old_space;
702+
unsigned int space, old_space;
702703
size_t tail;
703704
u8 c;
704705

0 commit comments

Comments
 (0)