Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

This project is archived. Its data is read-only.

Commit cc04a143 authored Feb 05, 2016 by Peter Hurley Committed by Greg Kroah-Hartman Jun 14, 2017

tty: Drop krefs for interrupted tty lock



commit e9036d0662360cd4c79578565ce422ed5872f301 upstream.

When the tty lock is interrupted on attempted re-open, 2 tty krefs
are still held. Drop extra kref before returning failure from
tty_lock_interruptible(), and drop lookup kref before returning
failure from tty_open().

Fixes: 0bfd464d3fdd ("tty: Wait interruptibly for tty lock on reopen")
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Cc: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 983c09eb

drivers/tty/tty_io.c

+1 −2

Original line number	Diff line number	Diff line
		@@ -2070,13 +2070,12 @@ retry_open:
		if (tty) {
		mutex_unlock(&tty_mutex);
		retval = tty_lock_interruptible(tty);
		tty_kref_put(tty); /* drop kref from tty_driver_lookup_tty() */
		if (retval) {
		if (retval == -EINTR)
		retval = -ERESTARTSYS;
		goto err_unref;
		}
		/* safe to drop the kref from tty_driver_lookup_tty() */
		tty_kref_put(tty);
		retval = tty_reopen(tty);
		if (retval < 0) {
		tty_unlock(tty);

drivers/tty/tty_mutex.c

+6 −1

Original line number	Diff line number	Diff line
		@@ -24,10 +24,15 @@ EXPORT_SYMBOL(tty_lock);

		int tty_lock_interruptible(struct tty_struct *tty)
		{
		int ret;

		if (WARN(tty->magic != TTY_MAGIC, "L Bad %p\n", tty))
		return -EIO;
		tty_kref_get(tty);
		return mutex_lock_interruptible(&tty->legacy_mutex);
		ret = mutex_lock_interruptible(&tty->legacy_mutex);
		if (ret)
		tty_kref_put(tty);
		return ret;
		}

		void __lockfunc tty_unlock(struct tty_struct *tty)