cvs commit: src/sys/kern tty.c

[John Baldwin]

jhb         2008-01-08 04:53:29 UTC

  FreeBSD src repository

  Modified files:
    sys/kern             tty.c 
  Log:
  Close a race in the kern.ttys sysctl handler that resulted in panics in
  dev2udev() when a tty was being detached concurrently with the sysctl
  handler:
  - Hold the 'tty_list_mutex' lock while we read all the fields out of the
    struct tty for copying out later.  Previously the pty(4) and pts(4)
    destroy routines could set t_dev to NULL, drop their reference on the
    tty and destroy the cdev while the sysctl handler was attempting to
    invoke dev2udev() on the cdev being destroyed.  This happened when the
    sysctl handler read the value of t_dev prior to it being set to NULL
    either due to it being stale or due to timing races.  By holding the
    list lock we guarantee that the destroy routines will block in ttyrel()
    in that case and not destroy the cdev until after we've copied all of our
    data.  We may see a NULL cdev pointer or we may see the previous value,
    but the previous value will no longer point to a destroyed cdev if we
    see it.
  - Fix the ttyfree() routine used by tty device drivers in their detach
    methods to use ttyrel() on the tty so we don't leak them.  Also, fix it
    to use the same order of operations as pty/pts destruction (set t_dev
    NULL, ttyrel(), destroy_dev()) so it cooperates with the sysctl handler.
  
  MFC after:      3 days
  Tested by:      avatar
  
  Revision  Changes    Path
  1.274     +20 -3     src/sys/kern/tty.c