From fb79aef8d87b57e244808b225e3cbc7c387b25b1 Mon Sep 17 00:00:00 2001 From: "kfraser@localhost.localdomain" Date: Mon, 10 Jul 2006 15:23:15 +0100 Subject: [PATCH] [XENCONSOLE] reference of tty->count in xencons_close() is racy. It must be protected by tty_sem semaphore like con_close() in drivers/char/vt.c. and prevent re-opening this tty. Signed-off-by: Isaku Yamahata Signed-off-by: Keir Fraser --- .../drivers/xen/console/console.c | 31 ++++++++++++------- 1 file changed, 20 insertions(+), 11 deletions(-) diff --git a/linux-2.6-xen-sparse/drivers/xen/console/console.c b/linux-2.6-xen-sparse/drivers/xen/console/console.c index 2e1017a224..ff1cfe2d7e 100644 --- a/linux-2.6-xen-sparse/drivers/xen/console/console.c +++ b/linux-2.6-xen-sparse/drivers/xen/console/console.c @@ -536,18 +536,27 @@ static void xencons_close(struct tty_struct *tty, struct file *filp) if (DUMMY_TTY(tty)) return; - if (tty->count == 1) { - tty->closing = 1; - tty_wait_until_sent(tty, 0); - if (DRV(tty->driver)->flush_buffer != NULL) - DRV(tty->driver)->flush_buffer(tty); - if (tty->ldisc.flush_buffer != NULL) - tty->ldisc.flush_buffer(tty); - tty->closing = 0; - spin_lock_irqsave(&xencons_lock, flags); - xencons_tty = NULL; - spin_unlock_irqrestore(&xencons_lock, flags); + down(&tty_sem); + + if (tty->count != 1) { + up(&tty_sem); + return; } + + /* Prevent other threads from re-opening this tty. */ + set_bit(TTY_CLOSING, &tty->flags); + up(&tty_sem); + + tty->closing = 1; + tty_wait_until_sent(tty, 0); + if (DRV(tty->driver)->flush_buffer != NULL) + DRV(tty->driver)->flush_buffer(tty); + if (tty->ldisc.flush_buffer != NULL) + tty->ldisc.flush_buffer(tty); + tty->closing = 0; + spin_lock_irqsave(&xencons_lock, flags); + xencons_tty = NULL; + spin_unlock_irqrestore(&xencons_lock, flags); } static struct tty_operations xencons_ops = { -- 2.30.2