VT ioctl race fix (8792f961) · Commits · 戴 / test

When calling the RELDISP VT ioctl, we are reading vt_newvt while the console workqueue could be messing with it (through change_console()). We fix this race by taking the console semaphore before reading vt_newvt. Signed-off-by:

Samuel Ortiz <sameo@openedhand.com> Acked-by:

Antonino Daplas <adaplas@gmail.com> Signed-off-by:

Andrew Morton <akpm@linux-foundation.org> Signed-off-by:

Linus Torvalds <torvalds@linux-foundation.org>

drivers/char/vt_ioctl.c

+5 −3

Original line number	Diff line number	Diff line
		@@ -770,6 +770,7 @@ int vt_ioctl(struct tty_struct tty, struct file file,
		/*
		* Switching-from response
		*/
		acquire_console_sem();
		if (vc->vt_newvt >= 0) {
		if (arg == 0)
		/*
		@@ -784,7 +785,6 @@ int vt_ioctl(struct tty_struct tty, struct file file,
		* complete the switch.
		*/
		int newvt;
		acquire_console_sem();
		newvt = vc->vt_newvt;
		vc->vt_newvt = -1;
		i = vc_allocate(newvt);
		@@ -798,7 +798,6 @@ int vt_ioctl(struct tty_struct tty, struct file file,
		* other console switches..
		*/
		complete_change_console(vc_cons[newvt].d);
		release_console_sem();
		}
		}

		@@ -810,9 +809,12 @@ int vt_ioctl(struct tty_struct tty, struct file file,
		/*
		* If it's just an ACK, ignore it
		*/
		if (arg != VT_ACKACQ)
		if (arg != VT_ACKACQ) {
		release_console_sem();
		return -EINVAL;
		}
		}
		release_console_sem();

		return 0;

Admin message