On Sun, 23 Jan 2005, Sergey Vlasov wrote:
>
> tty_poll() grabs ldisc reference for the tty it was called with;
> however, in this case pty_chars_in_buffer() accesses another ldisc
> (tty->link->ldisc) without grabbing a reference to it. BTW, many other
> pty_* functions do the same thing.
Yes, I think you put the finger on it.
> Is calling tty_ldisc_ref(tty->link) safe here? There is a comment
> warning about possible deadlocks before pty_write().
I think it's only the tty_ldisc_ref_wait() thing that can deadlock (and
even that is likely safe if you just specify an order - "masters first" or
something). Adding a nonblocking "tty_ldisc_ref()" looks safe, ie
something like the appended.
This has the problem (apart from the fact that it's obviously totally
untested ;) that it looks like every single pty function would need to do
it, so it would be nicer if "tty_ldisc_ref_wait()" would just always get
both references (ie do the ordering). Alan?
Linus
----
--- 1.32/drivers/char/pty.c 2005-01-10 17:29:36 -08:00
+++ edited/drivers/char/pty.c 2005-01-23 10:21:04 -08:00
@@ -149,13 +149,17 @@
static int pty_chars_in_buffer(struct tty_struct *tty)
{
struct tty_struct *to = tty->link;
- int count;
+ int count = 0;
- if (!to || !to->ldisc.chars_in_buffer)
- return 0;
-
- /* The ldisc must report 0 if no characters available to be read */
- count = to->ldisc.chars_in_buffer(to);
+ if (to) {
+ struct tty_ldisc *ld = tty_ldisc_ref(to);
+ if (ld) {
+ if (ld->chars_in_buffer) {
+ count = ld->chars_in_buffer(to);
+ tty_ldisc_deref(ld);
+ }
+ }
+ }
if (tty->driver->subtype == PTY_TYPE_SLAVE) return count;
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
