ldisc writes during tty release_dev() causing problems.

[Ryan Arnold <rsa@us.ibm.com>]

On Wed, 2004-09-15 at 15:41, Theodore Ts'o wrote:

> The current (I can't speak to what Alan Cox is going to change) rules
> with tty drivers is that tty drivers are supposed to close the line
> discpline in their close routines.  That's the much safer and cleaner
> way of fixing this problem, and it is in line with what most of the
> other tty drivers are doing.
> 					- Ted

Ted,

I greped through the drivers directory and it appears that the only tty
drivers that actually invoke ldisc.close() are those drivers that don't
use the N_TTY line discipline (serial drivers).

Many of the drivers actually call ldisc.flush_buffers() which
effectively does the same as a ldisc.close(), cleaning up the
tty->read_buf and tasks waiting on tty->read_wait.

The story is different with writes.  The tty layer dipatches a write via
the line discpline's write_chan() function.  The line discipline is then
responsible for delivering this data to the driver's write() function.

If driver->write() returns 0 [device is blocking] (which it can do often
in the case of hvc_console) the ldisc write_chan() function will
schedule() and get put on the tty->write_wait queue with the expectation
that it will be awoken by the driver when the device is available for
further writes.

If tty release_dev() is called when write_chan() is blocked awaiting I/O
with the driver and tty->count == 1 the final call to driver->close()
will clean up the driver without the ldisc knowing that the driver has
closed the device.

Following this release_dev() actually awakens the tty->write_wait, which
basically tells the ldisc to continue trying to send data to the driver
for the device it has just told the driver to close!

Ideally I would want hvc_close() to be able to tell the ldisc to wake up
the thread blocking on tty->write_wait and discard any unsent data. 
Unless I'm mistaken there is currrently no way to do this.

I suppose I could make hvc_write() return -EIO if hvc_struct->count ==
0.  I can't think of any races with this but it doesn't seem correct.

Additionally, there doesn't seem to be anything to prevent hangup being
called on a tty during the final close operation (this actually happened
in hvc_console).

Do you have any wisdom or advice?  Am I missing something obvious?

Ryan S. Arnold
IBM Linux Technology Center