diff options
| author | ed <ed@FreeBSD.org> | 2010-07-06 08:56:34 +0000 |
|---|---|---|
| committer | ed <ed@FreeBSD.org> | 2010-07-06 08:56:34 +0000 |
| commit | 1075ceb3e2f850c3ac510c4898404cde2ac12caf (patch) | |
| tree | 630ebeef105050520706ab58694cb8abe963c9e6 | |
| parent | 285c3f355cf6129d252b690ee2d17bc7d0964d7a (diff) | |
| download | FreeBSD-src-1075ceb3e2f850c3ac510c4898404cde2ac12caf.zip FreeBSD-src-1075ceb3e2f850c3ac510c4898404cde2ac12caf.tar.gz | |
Fix a race condition, where a TTY could be destroyed twice.
There are special cases where tty_rel_free() can be called twice in a
row, namely when closing and revoking the TTY at the same moment. Only
call destroy_dev_sched_cb() once.
Reported by: Jeremie Le Hen
MFC after: 1 week
| -rw-r--r-- | sys/kern/tty.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/sys/kern/tty.c b/sys/kern/tty.c index 1928c1f..917fb7b 100644 --- a/sys/kern/tty.c +++ b/sys/kern/tty.c @@ -1040,7 +1040,8 @@ tty_rel_free(struct tty *tp) tp->t_dev = NULL; tty_unlock(tp); - destroy_dev_sched_cb(dev, tty_dealloc, tp); + if (dev != NULL) + destroy_dev_sched_cb(dev, tty_dealloc, tp); } void |
