On Sat, 2016-01-09 at 20:41 -0800, Peter Hurley wrote:
> As the function documentation for tty_ldisc_ref_wait() notes, it is
> only callable from a tty file_operations routine; otherwise there
> is no guarantee the ref won't be NULL.
>
> The key difference with the VT's paste_selection() is that is an ioctl,
> where __speakup_paste_selection() is completely asynch kworker, kicked
> off from interrupt context.
>
> Fixes: 28a821c30688 ("Staging: speakup: Update __speakup_paste_selection()
> tty (ab)usage to match vt")
> Cc: <stable@xxxxxxxxxxxxxxx>
>
> Signed-off-by: Peter Hurley <peter@xxxxxxxxxxxxxxxxxx>
> ---
> drivers/staging/speakup/selection.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/staging/speakup/selection.c b/drivers/staging/speakup/selection.c
> index aa5ab6c..86c0b9a 100644
> --- a/drivers/staging/speakup/selection.c
> +++ b/drivers/staging/speakup/selection.c
> @@ -142,7 +142,9 @@ static void __speakup_paste_selection(struct work_struct *work)
> struct tty_ldisc *ld;
> DECLARE_WAITQUEUE(wait, current);
>
> - ld = tty_ldisc_ref_wait(tty);
> + ld = tty_ldisc_ref(tty);
> + if (!ld)
> + return;
> tty_buffer_lock_exclusive(&vc->port);
>
> add_wait_queue(&vc->paste_wait, &wait);
This leaks a reference to the tty. Instead of returning directly, I
think you need to add a label and goto the tty_kref_put() at the bottom
of the function.
Ben.
--
Ben Hutchings
Power corrupts. Absolute power is kind of neat.
- John Lehman, Secretary of the US Navy 1981-1987Attachment:
signature.asc
Description: This is a digitally signed message part