The patch titled
VT ioctl race fix
has been added to the -mm tree. Its filename is
vt-ioctl-race-fix.patch
*** Remember to use Documentation/SubmitChecklist when testing your code ***
See http://www.zip.com.au/~akpm/linux/patches/stuff/added-to-mm.txt to find
out what to do about this
------------------------------------------------------
Subject: VT ioctl race fix
From: Samuel Ortiz <sameo@xxxxxxxxxxxxxx>
When calling the RELDISP VT ioctl, we are reading vt_newvt while the
console workqueue could be messing with it (through change_console()). We
fix this race by taking the console semaphore before reading vt_newvt.
Signed-off-by: Samuel Ortiz <sameo@xxxxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
diff -puN drivers/char/vt_ioctl.c~vt-ioctl-race-fix drivers/char/vt_ioctl.c
--- a/drivers/char/vt_ioctl.c~vt-ioctl-race-fix
+++ a/drivers/char/vt_ioctl.c
@@ -812,6 +812,7 @@ int vt_ioctl(struct tty_struct *tty, str
/*
* Switching-from response
*/
+ acquire_console_sem();
if (vc->vt_newvt >= 0) {
if (arg == 0)
/*
@@ -826,7 +827,6 @@ int vt_ioctl(struct tty_struct *tty, str
* complete the switch.
*/
int newvt;
- acquire_console_sem();
newvt = vc->vt_newvt;
vc->vt_newvt = -1;
i = vc_allocate(newvt);
@@ -840,7 +840,6 @@ int vt_ioctl(struct tty_struct *tty, str
* other console switches..
*/
complete_change_console(vc_cons[newvt].d);
- release_console_sem();
}
}
@@ -852,9 +851,12 @@ int vt_ioctl(struct tty_struct *tty, str
/*
* If it's just an ACK, ignore it
*/
- if (arg != VT_ACKACQ)
+ if (arg != VT_ACKACQ) {
+ release_console_sem();
return -EINVAL;
+ }
}
+ release_console_sem();
return 0;
_
Patches currently in -mm which might be from sameo@xxxxxxxxxxxxxx are
vt-ioctl-race-fix.patch
-
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
