Date: Fri, 23 May 2008 16:47:55 +0000 (UTC) From: Konstantin Belousov <kib@FreeBSD.org> To: src-committers@FreeBSD.org, cvs-src@FreeBSD.org, cvs-all@FreeBSD.org Subject: cvs commit: src/sys/kern tty.c Message-ID: <200805231647.m4NGltnh009812@repoman.freebsd.org>
next in thread | raw e-mail | index | archive | help
kib 2008-05-23 16:47:55 UTC
FreeBSD src repository
Modified files:
sys/kern tty.c
Log:
Rev. 1.274 put the ttyrel() call before the destroy_dev() in the
ttyfree(), freeing the tty. Since destroy_dev() may call d_purge()
cdevsw method, that is the ttypurge() for the tty, the code ends up
accessing freed tty structure.
Put the ttyrel() after destroy_dev() in the ttyfree. To prevent the
panic the rev. 1.274 provided fix for, check the TS_GONE in sysctl
handler and refuse to provide information on such tty.
Reported, debugging help and tested by: pho
DIscussed with and reviewed by: jhb
MFC after: 1 week
Revision Changes Path
1.280 +5 -2 src/sys/kern/tty.c
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200805231647.m4NGltnh009812>