https://github.com/torvalds/linux
Revision f786648b89f00d4e66fe6b19beffd30e764651fc authored by Paul Mackerras on 27 August 2005, 23:40:01 UTC, committed by Linus Torvalds on 28 August 2005, 01:03:42 UTC
[ Same race and same patch also by Steven Rostedt <rostedt@goodmis.org> ] I have a laptop (G3 powerbook) which will pretty reliably hit a race between con_open and con_close late in the boot process and oops in vt_ioctl due to tty->driver_data being NULL. What happens is this: process A opens /dev/tty6; it comes into con_open() (drivers/char/vt.c) and assign a non-NULL value to tty->driver_data. Then process A closes that and concurrently process B opens /dev/tty6. Process A gets through con_close() and clears tty->driver_data, since tty->count == 1. However, before process A can decrement tty->count, we switch to process B (e.g. at the down(&tty_sem) call at drivers/char/tty_io.c line 1626). So process B gets to run and comes into con_open with tty->count == 2, as tty->count is incremented (in init_dev) before con_open is called. Because tty->count != 1, we don't set tty->driver_data. Then when the process tries to do anything with that fd, it oopses. The simple and effective fix for this is to test tty->driver_data rather than tty->count in con_open. The testing and setting of tty->driver_data is serialized with respect to the clearing of tty->driver_data in con_close by the console_sem. We can't get a situation where con_open sees tty->driver_data != NULL and then con_close on a different fd clears tty->driver_data, because tty->count is incremented before con_open is called. Thus this patch eliminates the race, and in fact with this patch my laptop doesn't oops. Signed-off-by: Paul Mackerras <paulus@samba.org> [ Same patch Signed-off-by: Steven Rostedt <rostedt@goodmis.org> in http://marc.theaimsgroup.com/?l=linux-kernel&m=112450820432121&w=2 ] Signed-off-by: Linus Torvalds <torvalds@osdl.org>
1 parent 3859f6a
Tip revision: f786648b89f00d4e66fe6b19beffd30e764651fc authored by Paul Mackerras on 27 August 2005, 23:40:01 UTC
[PATCH] Remove race between con_open and con_close
[PATCH] Remove race between con_open and con_close
Tip revision: f786648
File | Mode | Size |
---|---|---|
Documentation | ||
arch | ||
crypto | ||
drivers | ||
fs | ||
include | ||
init | ||
ipc | ||
kernel | ||
lib | ||
mm | ||
net | ||
scripts | ||
security | ||
sound | ||
usr | ||
COPYING | -rw-r--r-- | 18.3 KB |
CREDITS | -rw-r--r-- | 87.2 KB |
MAINTAINERS | -rw-r--r-- | 57.5 KB |
Makefile | -rw-r--r-- | 43.4 KB |
README | -rw-r--r-- | 14.2 KB |
REPORTING-BUGS | -rw-r--r-- | 3.0 KB |
Computing file changes ...