hvc_console: Fix race between hvc_close and hvc_remove
authorAmit Shah <amit.shah@redhat.com>
Fri, 12 Mar 2010 06:23:15 +0000 (11:53 +0530)
committerGreg Kroah-Hartman <gregkh@suse.de>
Fri, 19 Mar 2010 14:17:54 +0000 (07:17 -0700)
commite74d098c66543d0731de62eb747ccd5b636a6f4c
tree8ed9937f653cf42a82ca7bd319a69dd35fb2325d
parentf157b58511e56d418eb582de96fedc4ea03d8061
hvc_console: Fix race between hvc_close and hvc_remove

Alan pointed out a race in the code where hvc_remove is invoked. The
recent virtio_console work is the first user of hvc_remove().

Alan describes it thus:

The hvc_console assumes that a close and remove call can't occur at the
same time.

In addition tty_hangup(tty) is problematic as tty_hangup is asynchronous
itself....

So this can happen

        hvc_close                               hvc_remove
        hung up ? - no
                                                lock
                                                tty = hp->tty
                                                unlock
        lock
        hp->tty = NULL
        unlock
        notify del
        kref_put the hvc struct
        close completes
        tty is destroyed
                                                tty_hangup dead tty
                                                tty->ops will be NULL
                                                NULL->...

This patch adds some tty krefs and also converts to using tty_vhangup().

Reported-by: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: Amit Shah <amit.shah@redhat.com>
CC: Alan Cox <alan@lxorguk.ukuu.org.uk>
CC: linuxppc-dev@ozlabs.org
CC: Rusty Russell <rusty@rustcorp.com.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
drivers/char/hvc_console.c