summaryrefslogtreecommitdiff
path: root/arch/um/include/shared
diff options
context:
space:
mode:
authorAl Viro <viro@ftp.linux.org.uk>2011-09-15 03:21:25 +0400
committerLinus Torvalds <torvalds@linux-foundation.org>2011-09-15 05:09:37 +0400
commitf71f94845e0126884eca8ce57a92e30b189c8e71 (patch)
tree4284aa9143c6f1b5969da372a81bc75ba7ef4e3e /arch/um/include/shared
parentfbfe9c847edf57ac8232aeafb290f272289893a3 (diff)
downloadlinux-f71f94845e0126884eca8ce57a92e30b189c8e71.tar.xz
um: fix oopsable race in line_close()
tty->count is decremented only after ->close() had been called and several tasks can hit it in parallel. As the result, using tty->count to check if you are the last one is broken. We end up leaving line->tty not reset to NULL and the next IRQ on that sucker will blow up trying to dereference pointers from kfree'd struct tty. Fix is obvious: we need to use a counter of our own. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Richard Weinberger <richard@nod.at> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'arch/um/include/shared')
-rw-r--r--arch/um/include/shared/line.h1
1 files changed, 1 insertions, 0 deletions
diff --git a/arch/um/include/shared/line.h b/arch/um/include/shared/line.h
index 72f4f25af247..63df3ca02ac2 100644
--- a/arch/um/include/shared/line.h
+++ b/arch/um/include/shared/line.h
@@ -33,6 +33,7 @@ struct line_driver {
struct line {
struct tty_struct *tty;
spinlock_t count_lock;
+ unsigned long count;
int valid;
char *init_str;