svn commit: r209718 - head/sys/kern

[Ed Schouten]

Author: ed
Date: Tue Jul  6 08:56:34 2010
New Revision: 209718
URL: http://svn.freebsd.org/changeset/base/209718

Log:
  Fix a race condition, where a TTY could be destroyed twice.
  
  There are special cases where tty_rel_free() can be called twice in a
  row, namely when closing and revoking the TTY at the same moment. Only
  call destroy_dev_sched_cb() once.
  
  Reported by:	Jeremie Le Hen
  MFC after:	1 week

Modified:
  head/sys/kern/tty.c

Modified: head/sys/kern/tty.c
==============================================================================
--- head/sys/kern/tty.c	Tue Jul  6 07:11:04 2010	(r209717)
+++ head/sys/kern/tty.c	Tue Jul  6 08:56:34 2010	(r209718)
@@ -1040,7 +1040,8 @@ tty_rel_free(struct tty *tp)
 	tp->t_dev = NULL;
 	tty_unlock(tp);
 
-	destroy_dev_sched_cb(dev, tty_dealloc, tp);
+	if (dev != NULL)
+		destroy_dev_sched_cb(dev, tty_dealloc, tp);
 }
 
 void