Commit c6fb162e authored by Andrew Morton's avatar Andrew Morton Committed by Linus Torvalds

[PATCH] fix console oops/race

Finally nailed this sucker.

con_close() checks the tty->count and then sleeps in acquire_console_sem().
But another process can come in and grab a ref against the tty while
con_close() dropped the BKL.  But con_close() then proceeds to deallocate the
tty->driver_data anyway, even though the tty now has ->count == 2.

Fix that by moving the check for ->tty_count inside console_sem.
parent e30b878a
......@@ -2481,19 +2481,18 @@ static int con_open(struct tty_struct *tty, struct file * filp)
return 0;
}
static void con_close(struct tty_struct *tty, struct file * filp)
static void con_close(struct tty_struct *tty, struct file *filp)
{
acquire_console_sem();
if (tty && tty->count == 1) {
struct vt_struct *vt;
if (!tty || tty->count != 1)
return;
vcs_remove_devfs(tty);
acquire_console_sem();
vt = (struct vt_struct*)tty->driver_data;
vt = tty->driver_data;
if (vt)
vc_cons[vt->vc_num].d->vc_tty = NULL;
tty->driver_data = 0;
}
release_console_sem();
}
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment