diff options
author | mbr <mbr@FreeBSD.org> | 2006-09-23 14:52:46 +0000 |
---|---|---|
committer | mbr <mbr@FreeBSD.org> | 2006-09-23 14:52:46 +0000 |
commit | 9af53fcaabbc08489f360aaebe10bb92a9f7d9a6 (patch) | |
tree | b7fbc096684dfc7283496963c1653cc56c0b4fb9 /sys | |
parent | b8fd741213327cb2814fcafff57841e373a3df81 (diff) | |
download | FreeBSD-src-9af53fcaabbc08489f360aaebe10bb92a9f7d9a6.zip FreeBSD-src-9af53fcaabbc08489f360aaebe10bb92a9f7d9a6.tar.gz |
Check for tp->t_refcnt == 0 before doing anything in tty_open().
PR: 103520
MFC after: 1 week
Diffstat (limited to 'sys')
-rw-r--r-- | sys/kern/tty.c | 6 | ||||
-rw-r--r-- | sys/kern/tty_pty.c | 12 |
2 files changed, 18 insertions, 0 deletions
diff --git a/sys/kern/tty.c b/sys/kern/tty.c index f5b7d91..4701584 100644 --- a/sys/kern/tty.c +++ b/sys/kern/tty.c @@ -3067,6 +3067,12 @@ ttyopen(struct cdev *dev, int flag, int mode, struct thread *td) struct tty *tp; tp = dev->si_tty; + + /* XXX It can happen that devfs_open calls us with tp->t_refcnt == 0 */ + if (tp == NULL || tp->t_refcnt == 0) { + return (ENXIO); + } + s = spltty(); /* * We jump to this label after all non-interrupted sleeps to pick diff --git a/sys/kern/tty_pty.c b/sys/kern/tty_pty.c index 155b046..c861d40 100644 --- a/sys/kern/tty_pty.c +++ b/sys/kern/tty_pty.c @@ -196,6 +196,12 @@ ptsopen(struct cdev *dev, int flag, int devtype, struct thread *td) return(ENXIO); pt = dev->si_drv1; tp = dev->si_tty; + + /* XXX It can happen that devfs_open calls us with tp->t_refcnt == 0 */ + if (tp == NULL || tp->t_refcnt == 0) { + return (ENXIO); + } + if ((tp->t_state & TS_ISOPEN) == 0) { ttyinitmode(tp, 1, 0); } else if (tp->t_state & TS_XCLUDE && suser(td)) @@ -314,6 +320,12 @@ ptcopen(struct cdev *dev, int flag, int devtype, struct thread *td) if (!dev->si_drv1) return(ENXIO); tp = dev->si_tty; + + /* XXX It can happen that devfs_open calls us with tp->t_refcnt == 0 */ + if (tp == NULL || tp->t_refcnt == 0) { + return (ENXIO); + } + if (tp->t_oproc) return (EIO); tp->t_timeout = -1; |