[PATCH] tty: discard flip-buffer input for TCSAFLUSH

[Hungyu Lin]

set_termios() handles TERMIOS_FLUSH by clearing only the line discipline's
input buffer. Data already committed to the tty flip buffers can be
delivered after that flush, leaving old input readable after a successful
tcsetattr(TCSAFLUSH).

This can be reproduced with a raw PTY: complete an 8192-byte master write,
wait until the slave reports 4095 unread bytes, and apply TCSAFLUSH.
The remaining 4097 bytes are still readable afterwards. Small amounts of
pending input can also survive if they have not reached the line
discipline yet.

Use tty_buffer_flush() with the referenced line discipline to discard both
receive queues under the existing buffer lock. The helper checks for the
line discipline's flush_buffer callback itself.

Signed-off-by: Hungyu Lin <dennylin0707@xxxxxxxxx>
---
 drivers/tty/tty_ioctl.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/tty/tty_ioctl.c b/drivers/tty/tty_ioctl.c
index 90c70d8d14e3..45cb77185dbb 100644
--- a/drivers/tty/tty_ioctl.c
+++ b/drivers/tty/tty_ioctl.c
@@ -496,8 +496,8 @@ static int set_termios(struct tty_struct *tty, void __user *arg, int opt)
 
 		ld = tty_ldisc_ref(tty);
 		if (ld != NULL) {
-			if ((opt & TERMIOS_FLUSH) && ld->ops->flush_buffer)
-				ld->ops->flush_buffer(tty);
+			if (opt & TERMIOS_FLUSH)
+				tty_buffer_flush(tty, ld);
 			tty_ldisc_deref(ld);
 		}
 
-- 
2.43.0