On 08/29/2018, 04:23 AM, Dmitry Safonov wrote:
> In case of tty_ldisc_reinit() failure, tty->count should be decremented
> back, otherwise we will never release_tty().
> Never seen it in the real life, but it seems not really hard to hit.
I did see it. And this fixes it.
> Cc: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
> Cc: Jiri Slaby <jslaby@xxxxxxxx>
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Dmitry Safonov <dima@xxxxxxxxxx>
> ---
> drivers/tty/tty_io.c | 11 ++++++++---
> 1 file changed, 8 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
> index 32bc3e3fe4d3..5e5da9acaf0a 100644
> --- a/drivers/tty/tty_io.c
> +++ b/drivers/tty/tty_io.c
> @@ -1255,6 +1255,7 @@ static void tty_driver_remove_tty(struct tty_driver *driver, struct tty_struct *
> static int tty_reopen(struct tty_struct *tty)
> {
> struct tty_driver *driver = tty->driver;
> + int retval;
>
> if (driver->type == TTY_DRIVER_TYPE_PTY &&
> driver->subtype == PTY_TYPE_MASTER)
> @@ -1268,10 +1269,14 @@ static int tty_reopen(struct tty_struct *tty)
>
> tty->count++;
>
> - if (!tty->ldisc)
> - return tty_ldisc_reinit(tty, tty->termios.c_line);
> + if (tty->ldisc)
> + return 0;
>
> - return 0;
> + retval = tty_ldisc_reinit(tty, tty->termios.c_line);
> + if (retval)
> + tty->count--;
I would just do:
if (!retval)
tty->count++;
here. Nobody from ldiscs should rely on tty->count.
> + return retval;
thanks,
--
js
suse labs
