Messages in this thread | | | Date | Tue, 7 Jun 2011 10:10:43 -0700 | From | Greg KH <> | Subject | Re: [PATCH v2 2/2] TTY: ntty, add one more sanity check |
| |
On Tue, Jun 07, 2011 at 06:57:50PM +0200, Jiri Slaby wrote: > On 06/07/2011 06:44 PM, Greg KH wrote: > > On Sun, Jun 05, 2011 at 02:16:17PM +0200, Jiri Slaby wrote: > >> With the previous patch, we fixed another bug where read_buf was freed > >> while we still was in n_tty_read. We currently check whether read_buf > >> is NULL at the start of the function. Add one more check after we wake > >> up from waiting for input. > >> > >> Signed-off-by: Jiri Slaby <jslaby@suse.cz> > >> Cc: Alan Cox <alan@lxorguk.ukuu.org.uk> > >> --- > >> drivers/tty/n_tty.c | 1 + > >> 1 files changed, 1 insertions(+), 0 deletions(-) > >> > >> diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c > >> index 95d0a9c..c62c856 100644 > >> --- a/drivers/tty/n_tty.c > >> +++ b/drivers/tty/n_tty.c > >> @@ -1785,6 +1785,7 @@ do_it_again: > >> break; > >> } > >> timeout = schedule_timeout(timeout); > >> + BUG_ON(!tty->read_buf); > > > > So, if we ever hit this, what are we going to do with this crash? > > > > I really don't want to add more BUG_ON() calls to the kernel if at all > > possible. Or is it the case that we will crash if this case is true > > soon afterward anyway? > > Yeah, it will crash something like 10 lines below. The pointer is > dereferenced there.
Ok, fair enough, thanks.
greg k-h
| |