[PATCH] tty: discard flip-buffer input for TCSAFLUSH

[PATCH] tty: discard flip-buffer input for TCSAFLUSH

[Hungyu Lin]

set_termios() handles TERMIOS_FLUSH by clearing only the line discipline's
input buffer. Data already committed to the tty flip buffers can be
delivered after that flush, leaving old input readable after a successful
tcsetattr(TCSAFLUSH).

This can be reproduced with a raw PTY: complete an 8192-byte master write,
wait until the slave reports 4095 unread bytes, and apply TCSAFLUSH.
The remaining 4097 bytes are still readable afterwards. Small amounts of
pending input can also survive if they have not reached the line
discipline yet.

Use tty_buffer_flush() with the referenced line discipline to discard both
receive queues under the existing buffer lock. The helper checks for the
line discipline's flush_buffer callback itself.

Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
---
 drivers/tty/tty_ioctl.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/tty/tty_ioctl.c b/drivers/tty/tty_ioctl.c
index 90c70d8d14e3..45cb77185dbb 100644
--- a/drivers/tty/tty_ioctl.c
+++ b/drivers/tty/tty_ioctl.c
@@ -496,8 +496,8 @@ static int set_termios(struct tty_struct *tty, void __user *arg, int opt)
 
 		ld = tty_ldisc_ref(tty);
 		if (ld != NULL) {
-			if ((opt & TERMIOS_FLUSH) && ld->ops->flush_buffer)
-				ld->ops->flush_buffer(tty);
+			if (opt & TERMIOS_FLUSH)
+				tty_buffer_flush(tty, ld);
 			tty_ldisc_deref(ld);
 		}
 
-- 
2.43.0

Re: [PATCH] tty: discard flip-buffer input for TCSAFLUSH

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] tty: missing tty_unthrottle() in set_termios() on TERMIOS_FLUSH
--

commit 757d2dda2b0d44401d4d977f6413afe8f7669c45
Author: Hungyu Lin <dennylin0707@gmail.com>

tty: discard flip-buffer input for TCSAFLUSH

This commit updates set_termios() to call tty_buffer_flush() instead of only
invoking the line discipline flush_buffer callback when TERMIOS_FLUSH is set,
so pending input in the tty flip buffers is also discarded on TCSAFLUSH.

> diff --git a/drivers/tty/tty_ioctl.c b/drivers/tty/tty_ioctl.c
> index 90c70d8d14e3a..45cb77185dbb2 100644
> --- a/drivers/tty/tty_ioctl.c
> +++ b/drivers/tty/tty_ioctl.c
> @@ -496,8 +496,8 @@ static int set_termios(struct tty_struct *tty, void __user *arg, int opt)
>  
>  		ld = tty_ldisc_ref(tty);
>  		if (ld != NULL) {
> -			if ((opt & TERMIOS_FLUSH) && ld->ops->flush_buffer)
> -				ld->ops->flush_buffer(tty);
> +			if (opt & TERMIOS_FLUSH)
> +				tty_buffer_flush(tty, ld);

[Severity: High]
Should this path also call tty_unthrottle(tty) after flushing the buffers,
similar to how __tty_perform_flush() handles TCIFLUSH and TCIOFLUSH?

drivers/tty/tty_ioctl.c:__tty_perform_flush() {
	switch (arg) {
	case TCIFLUSH:
		if (ld && ld->ops->flush_buffer) {
			ld->ops->flush_buffer(tty);
			tty_unthrottle(tty);
		}
		break;
}

When a terminal using N_TTY fills ldata->read_buf and queues additional bytes
in the flip buffers, n_tty_receive_buf_common() sets ldata->no_room and calls
n_tty_check_throttle() -> tty_throttle_safe(), which sets TTY_THROTTLED and
throttles the underlying driver (or on a PTY pair, fills port->buf up to
mem_limit so the master blocks on write_wait).

Previously, set_termios() only called ld->ops->flush_buffer(tty), leaving the
flip buffer data intact to refill ldata->read_buf via flush_to_ldisc(), so a
subsequent n_tty_read() would still see input_available_p(tty, 0) and reach
n_tty_check_unthrottle(tty).

With tty_buffer_flush(tty, ld) now emptying both the flip buffers and
ldata->read_buf without calling tty_unthrottle(tty), a subsequent n_tty_read()
sees no available input and blocks in n_tty_wait_for_input() before reaching
n_tty_check_unthrottle(tty):

drivers/tty/n_tty.c:n_tty_read() {
		if (!input_available_p(tty, 0)) {
			up_read(&tty->termios_rwsem);
			tty_buffer_flush_work(tty->port);
			down_read(&tty->termios_rwsem);
			if (!input_available_p(tty, 0)) {
				int ret = n_tty_wait_for_input(tty, file, &wait,
							       &timeout);
				if (ret <= 0) {
					retval = ret;
					break;
				}
				continue;
			}
		}
}

Can this leave a throttled serial/USB-serial device unable to receive new
input to wake the reader, or leave a PTY master permanently blocked on
write_wait after tcsetattr() with TCSAFLUSH?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261027054304.35543-1-dennylin0707@gmail.com?part=1

Re: [PATCH] tty: discard flip-buffer input for TCSAFLUSH

[Greg KH]

On Tue, Oct 27, 2026 at 05:43:04AM +0000, Hungyu Lin wrote:
> set_termios() handles TERMIOS_FLUSH by clearing only the line discipline's
> input buffer. Data already committed to the tty flip buffers can be
> delivered after that flush, leaving old input readable after a successful
> tcsetattr(TCSAFLUSH).
> 
> This can be reproduced with a raw PTY: complete an 8192-byte master write,
> wait until the slave reports 4095 unread bytes, and apply TCSAFLUSH.
> The remaining 4097 bytes are still readable afterwards. Small amounts of
> pending input can also survive if they have not reached the line
> discipline yet.
> 
> Use tty_buffer_flush() with the referenced line discipline to discard both
> receive queues under the existing buffer lock. The helper checks for the
> line discipline's flush_buffer callback itself.
> 
> Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
> ---
>  drivers/tty/tty_ioctl.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/tty/tty_ioctl.c b/drivers/tty/tty_ioctl.c
> index 90c70d8d14e3..45cb77185dbb 100644
> --- a/drivers/tty/tty_ioctl.c
> +++ b/drivers/tty/tty_ioctl.c
> @@ -496,8 +496,8 @@ static int set_termios(struct tty_struct *tty, void __user *arg, int opt)
>  
>  		ld = tty_ldisc_ref(tty);
>  		if (ld != NULL) {
> -			if ((opt & TERMIOS_FLUSH) && ld->ops->flush_buffer)
> -				ld->ops->flush_buffer(tty);
> +			if (opt & TERMIOS_FLUSH)
> +				tty_buffer_flush(tty, ld);
>  			tty_ldisc_deref(ld);
>  		}
>  
> -- 
> 2.43.0
> 
> 

What commit id does this fix?  How was this tested?

thanks,

greg k-h

Re: [PATCH] tty: discard flip-buffer input for TCSAFLUSH

[Hungyu Lin]

> What commit id does this fix?  How was this tested?

The missing flip-buffer flush is already present in 1da177e4c3f4
(initial Git import). I could not identify its original introducing
commit.

Tested on ARM64 QEMU: an 8192-byte PTY write leaves 4097 stale bytes after
TCSAFLUSH before the fix, and none afterwards. Built the ARM64 Image and
32-bit x86 tty_ioctl.o with GCC 13.3.0, W=1.

I'll send v2 addressing the unthrottle issue.

Thanks,
Hungyu

Re: [PATCH] tty: discard flip-buffer input for TCSAFLUSH

[Greg KH]

On Tue, Oct 27, 2026 at 01:21:20AM -0700, Hungyu Lin wrote:
> > What commit id does this fix?  How was this tested?
> 
> The missing flip-buffer flush is already present in 1da177e4c3f4
> (initial Git import). I could not identify its original introducing
> commit.
> 
> Tested on ARM64 QEMU: an 8192-byte PTY write leaves 4097 stale bytes after
> TCSAFLUSH before the fix, and none afterwards. Built the ARM64 Image and
> 32-bit x86 tty_ioctl.o with GCC 13.3.0, W=1.

So as this is "just how things work" what is going to break with this
change?  Why change this at all at this point in time?  What needs this
fix?

And how was this found and tested?

thanks,

greg k-h

Re: [PATCH] tty: discard flip-buffer input for TCSAFLUSH

[Hungyu Lin]

> What is going to break with this change?

I missed that a throttled VT paste can hold the buffer lock and
block TCSAFLUSH.

> Why change this at all at this point in time?

I noticed the mismatch with the documented TCSAFLUSH behavior while
reviewing the code and thought it was a small fix.

> What needs this fix?

I don't have an application failure to point to.

> And how was this found and tested?

Found while reviewing set_termios(). The test completes an 8192-byte
master write to a raw PTY, waits for 4095 unread bytes on the slave,
then calls TCSAFLUSH there. It leaves 4097 bytes before the patch and
none afterwards. That PTY test didn't cover this VT interaction.

Thanks,
Hungyu