Commit c0253eec authored Jan 15, 2009 by Alan Cox Committed by Linus Torvalds Jan 15, 2009

tty: Fix race in the flush for some ldiscs



If you issue an ioctl to flush a tty as the line discipline is changing or
otherwise unplugged you can get a crash. The bug is very old but the rest
of the BKL lock dropping and some very "good" luck on Ingo's part caught
an example.

Use the correct ldisc_ref form so that we wait for the ldisc change to
complete and then flush

Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

parent 5393f780

drivers/char/tty_ioctl.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -1057,7 +1057,7 @@ int tty_perform_flush(struct tty_struct *tty, unsigned long arg)
		if (retval)
		return retval;

		ld = tty_ldisc_ref(tty);
		ld = tty_ldisc_ref_wait(tty);
		switch (arg) {
		case TCIFLUSH:
		if (ld && ld->ops->flush_buffer)

Admin message