svn commit: r209989 - stable/8/sys/kern

[Ed Schouten]

Author: ed
Date: Tue Jul 13 11:04:46 2010
New Revision: 209989
URL: http://svn.freebsd.org/changeset/base/209989

Log:
  MFC r209718:
  
    Fix a race condition, where a TTY could be destroyed twice.
  
    There are special cases where tty_rel_free() can be called twice in a
    row, namely when closing and revoking the TTY at the same moment. Only
    call destroy_dev_sched_cb() once.
  
  Reported by:  Jeremie Le Hen

Modified:
  stable/8/sys/kern/tty.c
Directory Properties:
  stable/8/sys/   (props changed)
  stable/8/sys/amd64/include/xen/   (props changed)
  stable/8/sys/cddl/contrib/opensolaris/   (props changed)
  stable/8/sys/contrib/dev/acpica/   (props changed)
  stable/8/sys/contrib/pf/   (props changed)
  stable/8/sys/dev/xen/xenpci/   (props changed)

Modified: stable/8/sys/kern/tty.c
==============================================================================
--- stable/8/sys/kern/tty.c	Tue Jul 13 10:32:43 2010	(r209988)
+++ stable/8/sys/kern/tty.c	Tue Jul 13 11:04:46 2010	(r209989)
@@ -1020,7 +1020,8 @@ tty_rel_free(struct tty *tp)
 	tp->t_dev = NULL;
 	tty_unlock(tp);
 
-	destroy_dev_sched_cb(dev, tty_dealloc, tp);
+	if (dev != NULL)
+		destroy_dev_sched_cb(dev, tty_dealloc, tp);
 }
 
 void