Date: Tue, 30 Mar 2004 18:26:27 -0800
From: Andrew Morton <akpm@osdl.org>
To: greg@kroah.com, linux-kernel@vger.kernel.org
Subject: Re: 2.6.5-rc3-mm1
Message-Id: <20040330182627.0e43f1ae.akpm@osdl.org>
In-Reply-To: <20040330162850.50a0fad4.akpm@osdl.org>
References: <20040330023437.72bb5192.akpm@osdl.org>
	<20040331000301.GB9269@kroah.com>
	<20040330162850.50a0fad4.akpm@osdl.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1317
Lines: 38

Andrew Morton <akpm@osdl.org> wrote:
>
> I'm thinking that this can be fixed from the other direction: just before
>  release_dev() calls close (dropping BKL), if tty->count==1, make the
>  going-away tty ineligible for concurrent lookups.  Do that by setting
>  tty->driver->ttys[idx] to NULL.  Maybe.

Famous last word: Volia!


diff -puN drivers/char/tty_io.c~tty-race-fix-42 drivers/char/tty_io.c
--- 25/drivers/char/tty_io.c~tty-race-fix-42	Tue Mar 30 16:30:55 2004
+++ 25-akpm/drivers/char/tty_io.c	Tue Mar 30 16:35:21 2004
@@ -1142,6 +1142,17 @@ static void release_dev(struct file * fi
 	}
 #endif
 
+	/*
+	 * ->close can sleep, and drop the BKL.  If this tty is about to
+	 * be destroyed we need to prevent other threads from coming in and
+	 * grabbing a new ref against the about-to-die tty.  Those threads
+	 * perform the lookup via tty->driver->ttys[], in init_dev().
+	 */
+	if (tty->count == 1) {
+		if (!(tty->driver->flags & TTY_DRIVER_DEVPTS_MEM))
+			tty->driver->ttys[idx] = NULL;
+	}
+
 	if (tty->driver->close)
 		tty->driver->close(tty, filp);
 

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/