lkml.org 
[lkml]   [2012]   [Mar]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] tty: hold lock across tty buffer finding and buffer filling
On 03/16/2012 10:49 AM, Du, Alek wrote:
> The tty structure is protect and not null, the tty->buf.tail is null. Many people think the tty reference count isn't protected and cause this bug, it is not true. :-)

You protect the pointer, not what is inside that structure. If you
increment a tty reference count, tty->buf.tail won't be NULL iff tty is
not NULL. IOW, you have to use tty_port_tty_set/get all around.

> For the flush case, it need acquire the spinlock to free the buffer and put buf.tail to NULL. So this patch will help:
>
> Here is the example place, you can see the __tty_buffer_flush is inside the spinlock.

I'm not talking about flush. I'm talking about prepare. It returns a
pointer to a tty buffer which may be concurrently freed by flush.

A B
================================================
prepare(&chars);
flush();
memcpy(chars, data_from_HW); <- chars is freed now
flip();
thanks,
--
js
suse labs


\
 
 \ /
  Last update: 2012-03-16 10:59    [from the cache]
©2003-2011 Jasper Spaans