cvs commit: src/sys/kern tty.c

[Konstantin Belousov]

kib         2008-05-23 16:47:55 UTC

  FreeBSD src repository

  Modified files:
    sys/kern             tty.c 
  Log:
  Rev. 1.274 put the ttyrel() call before the destroy_dev() in the
  ttyfree(), freeing the tty. Since destroy_dev() may call d_purge()
  cdevsw method, that is the ttypurge() for the tty, the code ends up
  accessing freed tty structure.
  
  Put the ttyrel() after destroy_dev() in the ttyfree. To prevent the
  panic the rev. 1.274 provided fix for, check the TS_GONE in sysctl
  handler and refuse to provide information on such tty.
  
  Reported, debugging help and tested by: pho
  DIscussed with and reviewed by: jhb
  MFC after:      1 week
  
  Revision  Changes    Path
  1.280     +5 -2      src/sys/kern/tty.c