diff options
| author | Al Viro <viro@ftp.linux.org.uk> | 2011-09-14 16:21:25 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2011-09-14 18:09:37 -0700 |
| commit | f71f94845e0126884eca8ce57a92e30b189c8e71 (patch) | |
| tree | 4284aa9143c6f1b5969da372a81bc75ba7ef4e3e /arch/um/include/shared | |
| parent | fbfe9c847edf57ac8232aeafb290f272289893a3 (diff) | |
| download | linux-3.10-f71f94845e0126884eca8ce57a92e30b189c8e71.tar.gz linux-3.10-f71f94845e0126884eca8ce57a92e30b189c8e71.tar.bz2 linux-3.10-f71f94845e0126884eca8ce57a92e30b189c8e71.zip | |
um: fix oopsable race in line_close()
tty->count is decremented only after ->close() had been called and
several tasks can hit it in parallel. As the result, using tty->count
to check if you are the last one is broken. We end up leaving line->tty
not reset to NULL and the next IRQ on that sucker will blow up trying to
dereference pointers from kfree'd struct tty.
Fix is obvious: we need to use a counter of our own.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'arch/um/include/shared')
| -rw-r--r-- | arch/um/include/shared/line.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/arch/um/include/shared/line.h b/arch/um/include/shared/line.h index 72f4f25af24..63df3ca02ac 100644 --- a/arch/um/include/shared/line.h +++ b/arch/um/include/shared/line.h @@ -33,6 +33,7 @@ struct line_driver { struct line { struct tty_struct *tty; spinlock_t count_lock; + unsigned long count; int valid; char *init_str; |