[Xen-changelog] [xen-unstable] [XENCONSOLE] reference of tty->count in xencons_close() is racy.

[Xen patchbot-unstable <patchbot-unstable@xxxxxxxxxxxxxxxxxxx>]

# HG changeset patch
# User kfraser@xxxxxxxxxxxxxxxxxxxxx
# Node ID 09b8041dc2fdf9e931f24ea2b6f601fbd51754fc
# Parent  c45f1f3a926b9b4f2d1edb9d7aab78f943ec4948
[XENCONSOLE] reference of tty->count in xencons_close() is racy.
It must be protected by tty_sem semaphore like con_close() in
drivers/char/vt.c. and prevent re-opening this tty.

Signed-off-by: Isaku Yamahata <yamahata@xxxxxxxxxxxxx>
Signed-off-by: Keir Fraser <keir@xxxxxxxxxxxxx>
---
 linux-2.6-xen-sparse/drivers/xen/console/console.c |   33 +++++++++++++--------
 1 files changed, 21 insertions(+), 12 deletions(-)

diff -r c45f1f3a926b -r 09b8041dc2fd 
linux-2.6-xen-sparse/drivers/xen/console/console.c
--- a/linux-2.6-xen-sparse/drivers/xen/console/console.c        Mon Jul 10 
15:18:53 2006 +0100
+++ b/linux-2.6-xen-sparse/drivers/xen/console/console.c        Mon Jul 10 
15:23:15 2006 +0100
@@ -536,18 +536,27 @@ static void xencons_close(struct tty_str
        if (DUMMY_TTY(tty))
                return;
 
-       if (tty->count == 1) {
-               tty->closing = 1;
-               tty_wait_until_sent(tty, 0);
-               if (DRV(tty->driver)->flush_buffer != NULL)
-                       DRV(tty->driver)->flush_buffer(tty);
-               if (tty->ldisc.flush_buffer != NULL)
-                       tty->ldisc.flush_buffer(tty);
-               tty->closing = 0;
-               spin_lock_irqsave(&xencons_lock, flags);
-               xencons_tty = NULL;
-               spin_unlock_irqrestore(&xencons_lock, flags);
-       }
+       down(&tty_sem);
+
+       if (tty->count != 1) {
+               up(&tty_sem);
+               return;
+       }
+
+       /* Prevent other threads from re-opening this tty. */
+       set_bit(TTY_CLOSING, &tty->flags);
+       up(&tty_sem);
+
+       tty->closing = 1;
+       tty_wait_until_sent(tty, 0);
+       if (DRV(tty->driver)->flush_buffer != NULL)
+               DRV(tty->driver)->flush_buffer(tty);
+       if (tty->ldisc.flush_buffer != NULL)
+               tty->ldisc.flush_buffer(tty);
+       tty->closing = 0;
+       spin_lock_irqsave(&xencons_lock, flags);
+       xencons_tty = NULL;
+       spin_unlock_irqrestore(&xencons_lock, flags);
 }
 
 static struct tty_operations xencons_ops = {

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog