Messages in this thread | | | Date | Sat, 23 Oct 2010 14:00:38 +0200 | From | Jiri Slaby <> | Subject | Re: [PATCH 28/49] tty: Add a new file /proc/tty/consoles |
| |
On 10/23/2010 01:51 PM, Al Viro wrote: > On Sat, Oct 23, 2010 at 01:40:24PM +0200, Jiri Slaby wrote: >> On 10/22/2010 08:21 PM, Greg Kroah-Hartman wrote: >>> +/* >>> + * Used for open /proc/tty/consoles. Before this detect >>> + * the device ID of file descriptor 0 of the current >>> + * reading task if a character device... >>> + */ >>> +static int tty_consoles_open(struct inode *inode, struct file *file) >>> +{ >>> + struct files_struct *curfiles; >>> + >>> + current_dev = 0; >>> + curfiles = get_files_struct(current); >>> + if (curfiles) { >>> + const struct file *curfp; >>> + spin_lock(&curfiles->file_lock); >>> + curfp = fcheck_files(curfiles, 0); >>> + if (curfp && curfp->private_data) { >>> + const struct inode *inode; >>> + dget(curfp->f_dentry); >>> + inode = curfp->f_dentry->d_inode; >>> + if (S_ISCHR(inode->i_mode)) { >>> + struct tty_struct *tty; >>> + tty = (struct tty_struct *)curfp->private_data; >>> + if (tty && tty->magic == TTY_MAGIC) { >> >> Ah, I've just understood what this code does. It seems, that the 'tty' >> at this point may be already freed (e.g. people don't set private_data >> to NULL). Please explain in the code why it can't... > > Please, don't. Even leaving aside the fact that it's mind-bogglingly > broken (->private_data can be _ANYTHING_, including arbitrary number cast > to pointer), you really shouldn't screw your way through the descriptor > table in the first place. > > Strongly NACKed.
Well, our complains are -ETOOLATE -- it's commit f4a3e0bceb57466c upstream. So please fix this up.
regards, -- js suse labs
| |