[lkml]   [2012]   [Mar]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [PATCH] tty: hold lock across tty buffer finding and buffer filling
On 03/16/2012 10:49 AM, Du, Alek wrote:
> The tty structure is protect and not null, the tty->buf.tail is null. Many people think the tty reference count isn't protected and cause this bug, it is not true. :-)

You protect the pointer, not what is inside that structure. If you
increment a tty reference count, tty->buf.tail won't be NULL iff tty is
not NULL. IOW, you have to use tty_port_tty_set/get all around.

> For the flush case, it need acquire the spinlock to free the buffer and put buf.tail to NULL. So this patch will help:
> Here is the example place, you can see the __tty_buffer_flush is inside the spinlock.

I'm not talking about flush. I'm talking about prepare. It returns a
pointer to a tty buffer which may be concurrently freed by flush.

memcpy(chars, data_from_HW); <- chars is freed now

suse labs

 \ /
  Last update: 2012-03-16 10:59    [W:0.043 / U:1.036 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site