Author: ed
Date: Tue Jul 6 08:56:34 2010
New Revision: 209718
URL: http://svn.freebsd.org/changeset/base/209718
Log:
Fix a race condition, where a TTY could be destroyed twice.
There are special cases where tty_rel_free() can be called twice in a
row, namely when closing and revoking the TTY at the same moment. Only
call destroy_dev_sched_cb() once.
Reported by: Jeremie Le Hen
MFC after: 1 week
Modified:
head/sys/kern/tty.c
Modified: head/sys/kern/tty.c
==============================================================================
--- head/sys/kern/tty.c Tue Jul 6 07:11:04 2010 (r209717)
+++ head/sys/kern/tty.c Tue Jul 6 08:56:34 2010 (r209718)
@@ -1040,7 +1040,8 @@ tty_rel_free(struct tty *tp)
tp->t_dev = NULL;
tty_unlock(tp);
- destroy_dev_sched_cb(dev, tty_dealloc, tp);
+ if (dev != NULL)
+ destroy_dev_sched_cb(dev, tty_dealloc, tp);
}
void
_______________________________________________
svn-src-head@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
