Re: 2.6.5-rc3-mm1

[Andrew Morton]

Andrew Morton <akpm@xxxxxxxx> wrote:
>
> I'm thinking that this can be fixed from the other direction: just before
>  release_dev() calls close (dropping BKL), if tty->count==1, make the
>  going-away tty ineligible for concurrent lookups.  Do that by setting
>  tty->driver->ttys[idx] to NULL.  Maybe.

Famous last word: Volia!


diff -puN drivers/char/tty_io.c~tty-race-fix-42 drivers/char/tty_io.c
--- 25/drivers/char/tty_io.c~tty-race-fix-42	Tue Mar 30 16:30:55 2004
+++ 25-akpm/drivers/char/tty_io.c	Tue Mar 30 16:35:21 2004
@@ -1142,6 +1142,17 @@ static void release_dev(struct file * fi
 	}
 #endif
 
+	/*
+	 * ->close can sleep, and drop the BKL.  If this tty is about to
+	 * be destroyed we need to prevent other threads from coming in and
+	 * grabbing a new ref against the about-to-die tty.  Those threads
+	 * perform the lookup via tty->driver->ttys[], in init_dev().
+	 */
+	if (tty->count == 1) {
+		if (!(tty->driver->flags & TTY_DRIVER_DEVPTS_MEM))
+			tty->driver->ttys[idx] = NULL;
+	}
+
 	if (tty->driver->close)
 		tty->driver->close(tty, filp);
 


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/