{"push_id":590994797,"size":1,"distinct_size":1,"ref":"refs/heads/cm-12.0_staging","head":"5b2e666b13a2437be09ec4a7b777c88c468a1b10","before":"a042a83d9344b3aaafef2c5a50b23bde793cf644","commits":[{"sha":"5b2e666b13a2437be09ec4a7b777c88c468a1b10","author":{"email":"4b8373d016f277527198385ba72fda0feb5da015@hurleysoftware.com","name":"Peter Hurley"},"message":"n_tty: Fix unsafe update of available buffer space\n\nreceive_room is used to control the amount of data the flip\nbuffer work can push to the read buffer. This update is unsafe:\n\n  CPU 0                        |  CPU 1\n                               |\n                               | n_tty_read()\n                               |   n_tty_set_room()\n                               |     left = <calc of space>\nn_tty_receive_buf()            |\n  <push data to buffer>        |\n  n_tty_set_room()             |\n    left = <calc of space>     |\n    tty->receive_room = left   |\n                               |     tty->receive_room = left\n\nreceive_room is now updated with a stale calculation of the\navailable buffer space, and the subsequent work loop will likely\noverwrite unread data in the input buffer.\n\nUpdate receive_room atomically with the calculation of the\navailable buffer space.\n\nSigned-off-by: Peter Hurley <peter@hurleysoftware.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n[rameezmustafa@codeaurora.org: use tty->read_lock instead of ldata->read_lock]\nSigned-off-by: Syed Rameez Mustafa <rameezmustafa@codeaurora.org>\nSigned-off-by: Pranav Vashi <neobuddy89@gmail.com>","distinct":true,"url":"https://api.github.com/repos/Starship-Android/android_kernel_lge_hammerhead-starship/commits/5b2e666b13a2437be09ec4a7b777c88c468a1b10"}]}