Re: 2.6.5-rc3-mm1

[Andrew Morton <akpm@osdl.org>]

Andrew Morton <akpm@osdl.org> wrote:
>
> I'm thinking that this can be fixed from the other direction: just before
>  release_dev() calls close (dropping BKL), if tty->count==1, make the
>  going-away tty ineligible for concurrent lookups.  Do that by setting
>  tty->driver->ttys[idx] to NULL.  Maybe.

Famous last word: Volia!


diff -puN drivers/char/tty_io.c~tty-race-fix-42 drivers/char/tty_io.c
--- 25/drivers/char/tty_io.c~tty-race-fix-42	Tue Mar 30 16:30:55 2004
+++ 25-akpm/drivers/char/tty_io.c	Tue Mar 30 16:35:21 2004
@@ -1142,6 +1142,17 @@ static void release_dev(struct file * fi
 	}
 #endif
 
+	/*
+	 * ->close can sleep, and drop the BKL.  If this tty is about to
+	 * be destroyed we need to prevent other threads from coming in and
+	 * grabbing a new ref against the about-to-die tty.  Those threads
+	 * perform the lookup via tty->driver->ttys[], in init_dev().
+	 */
+	if (tty->count == 1) {
+		if (!(tty->driver->flags & TTY_DRIVER_DEVPTS_MEM))
+			tty->driver->ttys[idx] = NULL;
+	}
+
 	if (tty->driver->close)
 		tty->driver->close(tty, filp);