ia64/xen-unstable

changeset 10713:09b8041dc2fd

find changesets by author, revision, files, or words in the commit message
[XENCONSOLE] reference of tty->count in xencons_close() is racy.
It must be protected by tty_sem semaphore like con_close() in
drivers/char/vt.c. and prevent re-opening this tty.

Signed-off-by: Isaku Yamahata <yamahata@valinux.co.jp>
Signed-off-by: Keir Fraser <keir@xensource.com>
author kfraser@localhost.localdomain
date Mon Jul 10 15:23:15 2006 +0100 (2006-07-10)
parents c45f1f3a926b
children a4041ac6f152
files linux-2.6-xen-sparse/drivers/xen/console/console.c
line diff
     1.1 --- a/linux-2.6-xen-sparse/drivers/xen/console/console.c	Mon Jul 10 15:18:53 2006 +0100
     1.2 +++ b/linux-2.6-xen-sparse/drivers/xen/console/console.c	Mon Jul 10 15:23:15 2006 +0100
     1.3 @@ -536,18 +536,27 @@ static void xencons_close(struct tty_str
     1.4  	if (DUMMY_TTY(tty))
     1.5  		return;
     1.6  
     1.7 -	if (tty->count == 1) {
     1.8 -		tty->closing = 1;
     1.9 -		tty_wait_until_sent(tty, 0);
    1.10 -		if (DRV(tty->driver)->flush_buffer != NULL)
    1.11 -			DRV(tty->driver)->flush_buffer(tty);
    1.12 -		if (tty->ldisc.flush_buffer != NULL)
    1.13 -			tty->ldisc.flush_buffer(tty);
    1.14 -		tty->closing = 0;
    1.15 -		spin_lock_irqsave(&xencons_lock, flags);
    1.16 -		xencons_tty = NULL;
    1.17 -		spin_unlock_irqrestore(&xencons_lock, flags);
    1.18 +	down(&tty_sem);
    1.19 +
    1.20 +	if (tty->count != 1) {
    1.21 +		up(&tty_sem);
    1.22 +		return;
    1.23  	}
    1.24 +
    1.25 +	/* Prevent other threads from re-opening this tty. */
    1.26 +	set_bit(TTY_CLOSING, &tty->flags);
    1.27 +	up(&tty_sem);
    1.28 +
    1.29 +	tty->closing = 1;
    1.30 +	tty_wait_until_sent(tty, 0);
    1.31 +	if (DRV(tty->driver)->flush_buffer != NULL)
    1.32 +		DRV(tty->driver)->flush_buffer(tty);
    1.33 +	if (tty->ldisc.flush_buffer != NULL)
    1.34 +		tty->ldisc.flush_buffer(tty);
    1.35 +	tty->closing = 0;
    1.36 +	spin_lock_irqsave(&xencons_lock, flags);
    1.37 +	xencons_tty = NULL;
    1.38 +	spin_unlock_irqrestore(&xencons_lock, flags);
    1.39  }
    1.40  
    1.41  static struct tty_operations xencons_ops = {