tty: Fix race in the flush for some ldiscs
If you issue an ioctl to flush a tty as the line discipline is changing or otherwise unplugged you can get a crash. The bug is very old but the rest of the BKL lock dropping and some very "good" luck on Ingo's part caught an example. Use the correct ldisc_ref form so that we wait for the ldisc change to complete and then flush Signed-off-by: Alan Cox <alan@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
@@ -1057,7 +1057,7 @@ int tty_perform_flush(struct tty_struct *tty, unsigned long arg)
|
|||||||
if (retval)
|
if (retval)
|
||||||
return retval;
|
return retval;
|
||||||
|
|
||||||
ld = tty_ldisc_ref(tty);
|
ld = tty_ldisc_ref_wait(tty);
|
||||||
switch (arg) {
|
switch (arg) {
|
||||||
case TCIFLUSH:
|
case TCIFLUSH:
|
||||||
if (ld && ld->ops->flush_buffer)
|
if (ld && ld->ops->flush_buffer)
|
||||||
|
Reference in New Issue
Block a user