Re: [RFC PATCH] tty: flush buffer on signal interrupted tty close

[Johan Hovold <johan@kernel.org>]

On Mon, Nov 01, 2021 at 05:48:08PM +0200, Baruch Siach wrote:
> When a signal interrupts tty_wait_until_sent() on a UART device, there
> might be data left on the xmit buffer that the UART will never transmit.
> This causes set_termios() to wait forever in tty_wait_until_sent().
> 
> The hang reproduces easily on my system that is equipped with DesignWare
> 8250. Run
> 
>   while true; do echo -ne 0123456789abcdef01 > /dev/ttyS1; done
> 
> Hit Ctrl-C to interrupt the loop. When data is left in the struct
> uart_state xmit buffer, the following command hangs:
> 
>   stty -F /dev/ttyS1 raw -echo

Thanks for reporting this. It should not be possible for there to be
data left in the buffer and indeed we do have a long-standing regression
here since the serdev work five years ago. I'm a bit surprised no one
has noticed and reported this for that long.

> Call tty_driver_flush_buffer() on signal interrupted wait, to discard
> data from the xmit buffer.
>
> Signed-off-by: Baruch Siach <baruch@tkos.co.il>
> ---
>  drivers/tty/tty_ioctl.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/tty/tty_ioctl.c b/drivers/tty/tty_ioctl.c
> index 507a25d692bb..0bf6fad7ecb3 100644
> --- a/drivers/tty/tty_ioctl.c
> +++ b/drivers/tty/tty_ioctl.c
> @@ -203,6 +203,8 @@ void tty_wait_until_sent(struct tty_struct *tty, long timeout)
>  
>  	timeout = wait_event_interruptible_timeout(tty->write_wait,
>  			!tty_chars_in_buffer(tty), timeout);
> +	if (timeout == -ERESTARTSYS && tty->closing)
> +		tty_driver_flush_buffer(tty);
>  	if (timeout <= 0)
>  		return;

This is however not the right fix since the problem isn't limited to
interrupted waits and in any case should not be handled in
tty_wait_until_sent().

I can reproduce the problem and have posted a fix here:

	https://lore.kernel.org/r/20211108083856.5261-1-johan@kernel.org

Johan