Date: Fri, 30 May 2008 11:13:30 +0000 (UTC) From: Konstantin Belousov <kib@FreeBSD.org> To: src-committers@FreeBSD.org, cvs-src@FreeBSD.org, cvs-all@FreeBSD.org Subject: cvs commit: src/sys/kern tty.c Message-ID: <200805301113.m4UBDUMg097884@repoman.freebsd.org>
next in thread | raw e-mail | index | archive | help
kib 2008-05-30 11:13:30 UTC
FreeBSD src repository
Modified files: (Branch: RELENG_7)
sys/kern tty.c
Log:
MFC rev. 1.280:
Rev. 1.274 put the ttyrel() call before the destroy_dev() in the
ttyfree(), freeing the tty. Since destroy_dev() may call d_purge()
cdevsw method, that is the ttypurge() for the tty, the code ends up
accessing freed tty structure.
Put the ttyrel() after destroy_dev() in the ttyfree. To prevent the
panic the rev. 1.274 provided fix for, check the TS_GONE in sysctl
handler and refuse to provide information on such tty.
Revision Changes Path
1.273.2.4 +5 -2 src/sys/kern/tty.c
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200805301113.m4UBDUMg097884>