Re: 2.6.5-rc3-mm1

Andrew Morton
2004-03-31T02:26:32Z

Andrew Morton <akpm@osdl.org> wrote:
>
> I'm thinking that this can be fixed from the other direction: just before
> release_dev() calls close (dropping BKL), if tty->count==1, make the
> going-away tty ineligible for concurrent lookups. Do that by setting
> tty->driver->ttys[idx] to NULL. Maybe.

Famous last word: Volia!

diff -puN drivers/char/tty_io.c~tty-race-fix-42 drivers/char/tty_io.c
--- 25/drivers/char/tty_io.c~tty-race-fix-42 Tue Mar 30 16:30:55 2004
+++ 25-akpm/drivers/char/tty_io.c Tue Mar 30 16:35:21 2004
@@ -1142,6 +1142,17 @@ static void release_dev(struct file * fi
}
#endif

+ /*
+ * ->close can sleep, and drop the BKL. If this tty is about to
+ * be destroyed we need to prevent other threads from coming in and
+ * grabbing a new ref against the about-to-die tty. Those threads
+ * perform the lookup via tty->driver->ttys[], in init_dev().
+ */
+ if (tty->count == 1) {
+ if (!(tty->driver->flags & TTY_DRIVER_DEVPTS_MEM))
+ tty->driver->ttys[idx] = NULL;
+ }
+
if (tty->driver->close)
tty->driver->close(tty, filp);