[PATCH v2] tty: discard flip-buffer input for TCSAFLUSH

[Hungyu Lin]

set_termios() handles TERMIOS_FLUSH by clearing only the line discipline's
input buffer. Data already committed to the tty flip buffers can be
delivered after that flush, leaving old input readable after a successful
tcsetattr(TCSAFLUSH).

This can be reproduced with a noncanonical PTY: complete an 8192-byte
master write, wait until the slave reports 4095 unread bytes, and apply
TCSAFLUSH. The remaining 4097 bytes are still readable afterwards. Small
amounts of pending input can also survive if they have not reached the
line discipline yet.

Use tty_buffer_flush() with the referenced line discipline to discard both
receive queues under the existing buffer lock. If the line discipline has
a flush_buffer callback, also unthrottle the tty after releasing that lock,
as TCIFLUSH does. Otherwise a paused input source or sleeping PTY writer
can remain stopped after the queues are emptied.

Signed-off-by: Hungyu Lin <dennylin0707@xxxxxxxxx>
---
Changes in v2:
- Unthrottle after flushing when the line discipline has a flush_buffer
  callback, matching TCIFLUSH and addressing Sashiko's review.
- Add local blocked-writer and serial-type N_TTY flow-control validation;
  rerun the original functional and sudo/PAM tests. Test harnesses are
  kept outside this patch.

 drivers/tty/tty_ioctl.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/tty/tty_ioctl.c b/drivers/tty/tty_ioctl.c
index 90c70d8d14e3..be764f04bf3a 100644
--- a/drivers/tty/tty_ioctl.c
+++ b/drivers/tty/tty_ioctl.c
@@ -496,8 +496,11 @@ static int set_termios(struct tty_struct *tty, void __user *arg, int opt)
 
 		ld = tty_ldisc_ref(tty);
 		if (ld != NULL) {
-			if ((opt & TERMIOS_FLUSH) && ld->ops->flush_buffer)
-				ld->ops->flush_buffer(tty);
+			if (opt & TERMIOS_FLUSH) {
+				tty_buffer_flush(tty, ld);
+				if (ld->ops->flush_buffer)
+					tty_unthrottle(tty);
+			}
 			tty_ldisc_deref(ld);
 		}
 
-- 
2.43.0