Date: Fri, 23 May 2008 16:47:55 +0000 (UTC) From: Konstantin Belousov <kib@FreeBSD.org> To: src-committers@FreeBSD.org, cvs-src@FreeBSD.org, cvs-all@FreeBSD.org Subject: cvs commit: src/sys/kern tty.c Message-ID: <200805231647.m4NGltnh009812@repoman.freebsd.org>
next in thread | raw e-mail | index | archive | help
kib 2008-05-23 16:47:55 UTC FreeBSD src repository Modified files: sys/kern tty.c Log: Rev. 1.274 put the ttyrel() call before the destroy_dev() in the ttyfree(), freeing the tty. Since destroy_dev() may call d_purge() cdevsw method, that is the ttypurge() for the tty, the code ends up accessing freed tty structure. Put the ttyrel() after destroy_dev() in the ttyfree. To prevent the panic the rev. 1.274 provided fix for, check the TS_GONE in sysctl handler and refuse to provide information on such tty. Reported, debugging help and tested by: pho DIscussed with and reviewed by: jhb MFC after: 1 week Revision Changes Path 1.280 +5 -2 src/sys/kern/tty.c
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200805231647.m4NGltnh009812>