tty/vt/keyboard: fix OOB access in do_compute_shiftstate()

[pandora-kernel.git] / drivers / tty / tty_ioctl.c

diff --git a/drivers/tty/tty_ioctl.c b/drivers/tty/tty_ioctl.c
index 9314d93..1740117 100644 (file)
--- a/drivers/tty/tty_ioctl.c
+++ b/drivers/tty/tty_ioctl.c
@@ -154,11 +154,17 @@ void tty_wait_until_sent(struct tty_struct *tty, long timeout)
 #endif
        if (!timeout)
                timeout = MAX_SCHEDULE_TIMEOUT;
+
        if (wait_event_interruptible_timeout(tty->write_wait,
-                       !tty_chars_in_buffer(tty), timeout) >= 0) {
-               if (tty->ops->wait_until_sent)
-                       tty->ops->wait_until_sent(tty, timeout);
+                       !tty_chars_in_buffer(tty), timeout) < 0) {
+               return;
        }
+
+       if (timeout == MAX_SCHEDULE_TIMEOUT)
+               timeout = 0;
+
+       if (tty->ops->wait_until_sent)
+               tty->ops->wait_until_sent(tty, timeout);
 }
 EXPORT_SYMBOL(tty_wait_until_sent);
 
@@ -618,7 +624,7 @@ static int set_termios(struct tty_struct *tty, void __user *arg, int opt)
        if (opt & TERMIOS_WAIT) {
                tty_wait_until_sent(tty, 0);
                if (signal_pending(current))
-                       return -EINTR;
+                       return -ERESTARTSYS;
        }
 
        tty_set_termios(tty, &tmp_termios);
@@ -685,7 +691,7 @@ static int set_termiox(struct tty_struct *tty, void __user *arg, int opt)
        if (opt & TERMIOS_WAIT) {
                tty_wait_until_sent(tty, 0);
                if (signal_pending(current))
-                       return -EINTR;
+                       return -ERESTARTSYS;
        }
 
        mutex_lock(&tty->termios_mutex);