Commit 4b41b953 authored Oct 10, 2015 by Peter Hurley Committed by Greg Kroah-Hartman Oct 17, 2015

tty: Prevent tty teardown during tty_write_message()



tty_write_message() allows the caller to directly write to a specific
tty. Since the line discipline is bypassed for the direct write,
nothing prevents the tty from being torn down after the tty count is
checked.

Hold the tty lock for the duration of the direct write.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 1e86b5bf

drivers/tty/tty_io.c

+2 −4

Original line number	Diff line number	Diff line
		@@ -1200,10 +1200,8 @@ void tty_write_message(struct tty_struct tty, char msg)
		if (tty) {
		mutex_lock(&tty->atomic_write_lock);
		tty_lock(tty);
		if (tty->ops->write && tty->count > 0) {
		tty_unlock(tty);
		if (tty->ops->write && tty->count > 0)
		tty->ops->write(tty, msg, strlen(msg));
		} else
		tty_unlock(tty);
		tty_write_unlock(tty);
		}