Patch "n_tty: Fix unsafe reference to "other" ldisc" has been added to the 4.3-stable tree

This is a note to let you know that I've just added the patch titled

n_tty: Fix unsafe reference to "other" ldisc

to the 4.3-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
n_tty-fix-unsafe-reference-to-other-ldisc.patch
and it can be found in the queue-4.3 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Peter Hurley <[email protected]>
Date: Sun, 10 Jan 2016 22:40:56 -0800
Subject: n_tty: Fix unsafe reference to "other" ldisc

From: Peter Hurley <[email protected]>

commit 6d27a63caad3f13e96cf065d2d96828c2006be6b upstream.

Although n_tty_check_unthrottle() has a valid ldisc reference (since the tty core gets the ldisc ref in tty_read() before calling the line discipline read() method), it does not have a valid ldisc reference to the "other" pty of a pty pair. Since getting an ldisc reference for tty->link essentially open-codes tty_wakeup(), just replace with the equivalent tty_wakeup().

---
 drivers/tty/n_tty.c |    7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

@@ -258,16 +258,13 @@ static void n_tty_check_throttle(struct
 
 static void n_tty_check_unthrottle(struct tty_struct *tty)
 {
-	if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
-	    tty->link->ldisc->ops->write_wakeup == n_tty_write_wakeup) {
+	if (tty->driver->type == TTY_DRIVER_TYPE_PTY) {
 		if (chars_in_buffer(tty) > TTY_THRESHOLD_UNTHROTTLE)
 			return;
 		if (!tty->count)
 			return;
 		n_tty_kick_worker(tty);
-		n_tty_write_wakeup(tty->link);
-		if (waitqueue_active(&tty->link->write_wait))
-			wake_up_interruptible_poll(&tty->link->write_wait, POLLOUT);
+		tty_wakeup(tty->link);
 		return;
 	}
 

Patches currently in stable-queue which might be from [email protected] are

queue-4.3/n_tty-fix-unsafe-reference-to-other-ldisc.patch queue-4.3/tty-fix-unsafe-ldisc-reference-via-ioctl-tiocgetd.patch queue-4.3/n_tty-fix-poll-after-buffer-limited-eof-push-read.patch queue-4.3/tty-fix-gpf-in-flush_to_ldisc.patch queue-4.3/tty-retry-failed-reopen-if-tty-teardown-in-progress.patch