tag c47438dbd70b116d03d51a669526938cf9ae69e8
tagger John Kacur <jkacur@redhat.com> Fri Apr 09 14:54:29 2010 +0200
object 00278eacba77d67ec3fc2fded47984b0f0c061a8

linux-2.6.33.2-rt13-mrg12

commit 00278eacba77d67ec3fc2fded47984b0f0c061a8
author Amit Shah <amit.shah@redhat.com> Fri Mar 12 11:53:15 2010 +0530
committer John Kacur <jkacur@redhat.com> Fri Apr 09 14:51:41 2010 +0200
tree 47f0cfc3ce9ed4964c6f9f4c26b136c816dcdc27
parent dfbeeff9b6d9ee68d44ddd8466e4d748b3897cf1

hvc_console: Fix race between hvc_close and hvc_remove

Alan pointed out a race in the code where hvc_remove is invoked. The
recent virtio_console work is the first user of hvc_remove().

Alan describes it thus:

The hvc_console assumes that a close and remove call can't occur at the
same time.

In addition tty_hangup(tty) is problematic as tty_hangup is asynchronous
itself....

So this can happen

        hvc_close                               hvc_remove
        hung up ? - no
                                                lock
                                                tty = hp->tty
                                                unlock
        lock
        hp->tty = NULL
        unlock
        notify del
        kref_put the hvc struct
        close completes
        tty is destroyed
                                                tty_hangup dead tty
                                                tty->ops will be NULL
                                                NULL->...

This patch adds some tty krefs and also converts to using tty_vhangup().

Reported-by: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: Amit Shah <amit.shah@redhat.com>
CC: Alan Cox <alan@lxorguk.ukuu.org.uk>
CC: linuxppc-dev@ozlabs.org
CC: Rusty Russell <rusty@rustcorp.com.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>