Messages in this thread | | | Date | Fri, 16 Mar 2012 10:57:01 +0100 | From | Jiri Slaby <> | Subject | Re: [PATCH] tty: hold lock across tty buffer finding and buffer filling |
| |
On 03/16/2012 10:49 AM, Du, Alek wrote: > The tty structure is protect and not null, the tty->buf.tail is null. Many people think the tty reference count isn't protected and cause this bug, it is not true. :-)
You protect the pointer, not what is inside that structure. If you increment a tty reference count, tty->buf.tail won't be NULL iff tty is not NULL. IOW, you have to use tty_port_tty_set/get all around.
> For the flush case, it need acquire the spinlock to free the buffer and put buf.tail to NULL. So this patch will help: > > Here is the example place, you can see the __tty_buffer_flush is inside the spinlock.
I'm not talking about flush. I'm talking about prepare. It returns a pointer to a tty buffer which may be concurrently freed by flush.
A B ================================================ prepare(&chars); flush(); memcpy(chars, data_from_HW); <- chars is freed now flip();
thanks, -- js suse labs
| |