From: Alan Cox <alan@redhat.com>
Date: Thu, 15 Jan 2009 13:30:25 +0000 (+0000)
Subject: tty: Fix race in the flush for some ldiscs
X-Git-Tag: v2.6.29-rc2~75
X-Git-Url: http://pilppa.com/gitweb/?a=commitdiff_plain;h=c0253eec2a8e1140dd9672a1efe095cdcf5811d0;p=linux-2.6-omap-h63xx.git

tty: Fix race in the flush for some ldiscs

If you issue an ioctl to flush a tty as the line discipline is changing or
otherwise unplugged you can get a crash. The bug is very old but the rest
of the BKL lock dropping and some very "good" luck on Ingo's part caught
an example.

Use the correct ldisc_ref form so that we wait for the ldisc change to
complete and then flush

Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
---

diff --git a/drivers/char/tty_ioctl.c b/drivers/char/tty_ioctl.c
index a408c8e487e..6f4c7d0a53b 100644
--- a/drivers/char/tty_ioctl.c
+++ b/drivers/char/tty_ioctl.c
@@ -1057,7 +1057,7 @@ int tty_perform_flush(struct tty_struct *tty, unsigned long arg)
 	if (retval)
 		return retval;
 
-	ld = tty_ldisc_ref(tty);
+	ld = tty_ldisc_ref_wait(tty);
 	switch (arg) {
 	case TCIFLUSH:
 		if (ld && ld->ops->flush_buffer)