Date: Wed, 12 Nov 2008 09:04:44 +0000 (UTC) From: Ed Schouten <ed@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r184866 - head/sys/kern Message-ID: <200811120904.mAC94iGf024905@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: ed Date: Wed Nov 12 09:04:44 2008 New Revision: 184866 URL: http://svn.freebsd.org/changeset/base/184866 Log: Don't forget to relock the TTY after uiomove() returns an error. Peter Holm just discovered this funny bug inside the TTY code: if uiomove() in ttydisc_write() returns an error, we forget to relock the TTY before jumping out of ttydisc_write(). Fix it by placing tty_unlock() and tty_lock() around uiomove(). Submitted by: pho Modified: head/sys/kern/tty_ttydisc.c Modified: head/sys/kern/tty_ttydisc.c ============================================================================== --- head/sys/kern/tty_ttydisc.c Wed Nov 12 08:29:26 2008 (r184865) +++ head/sys/kern/tty_ttydisc.c Wed Nov 12 09:04:44 2008 (r184866) @@ -460,17 +460,15 @@ ttydisc_write(struct tty *tp, struct uio MPASS(oblen == 0); /* Step 1: read data. */ - - tty_unlock(tp); - obstart = ob; nlen = MIN(uio->uio_resid, sizeof ob); + tty_unlock(tp); error = uiomove(ob, nlen, uio); + tty_lock(tp); if (error != 0) break; oblen = nlen; - tty_lock(tp); if (tty_gone(tp)) { error = ENXIO; break;
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200811120904.mAC94iGf024905>