From: Al Viro <viro@ftp.linux.org.uk>
Date: Wed, 14 Sep 2011 23:21:25 +0000 (-0700)
Subject: um: fix oopsable race in line_close()
X-Git-Tag: v3.1-rc7~55
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f71f94845e0126884eca8ce57a92e30b189c8e71;p=pandora-kernel.git

um: fix oopsable race in line_close()

tty->count is decremented only after ->close() had been called and
several tasks can hit it in parallel.  As the result, using tty->count
to check if you are the last one is broken.  We end up leaving line->tty
not reset to NULL and the next IRQ on that sucker will blow up trying to
dereference pointers from kfree'd struct tty.

Fix is obvious: we need to use a counter of our own.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
---

Reading git-diff-tree failed