diff options
author | ed <ed@FreeBSD.org> | 2008-11-12 09:04:44 +0000 |
---|---|---|
committer | ed <ed@FreeBSD.org> | 2008-11-12 09:04:44 +0000 |
commit | 172272452387fcd05f0e5fdd7dbeccedd43af76f (patch) | |
tree | e71439bf408e0357648d3205d3c841d9dbf73072 /sys/kern | |
parent | bae7e3ef64374d24a9ddb3967b8d4050f60ea54e (diff) | |
download | FreeBSD-src-172272452387fcd05f0e5fdd7dbeccedd43af76f.zip FreeBSD-src-172272452387fcd05f0e5fdd7dbeccedd43af76f.tar.gz |
Don't forget to relock the TTY after uiomove() returns an error.
Peter Holm just discovered this funny bug inside the TTY code: if
uiomove() in ttydisc_write() returns an error, we forget to relock the
TTY before jumping out of ttydisc_write(). Fix it by placing
tty_unlock() and tty_lock() around uiomove().
Submitted by: pho
Diffstat (limited to 'sys/kern')
-rw-r--r-- | sys/kern/tty_ttydisc.c | 6 |
1 files changed, 2 insertions, 4 deletions
diff --git a/sys/kern/tty_ttydisc.c b/sys/kern/tty_ttydisc.c index 0d7dd7f..800ad13 100644 --- a/sys/kern/tty_ttydisc.c +++ b/sys/kern/tty_ttydisc.c @@ -460,17 +460,15 @@ ttydisc_write(struct tty *tp, struct uio *uio, int ioflag) MPASS(oblen == 0); /* Step 1: read data. */ - - tty_unlock(tp); - obstart = ob; nlen = MIN(uio->uio_resid, sizeof ob); + tty_unlock(tp); error = uiomove(ob, nlen, uio); + tty_lock(tp); if (error != 0) break; oblen = nlen; - tty_lock(tp); if (tty_gone(tp)) { error = ENXIO; break; |