From: Antonino A. D. <ad...@gm...> - 2007-09-29 02:47:56
|
From: Samuel Ortiz <sa...@op...> When calling the RELDISP VT ioctl, we are reading vt_newvt while the console workqueue could be messing with it (through change_console()). We fix this race by taking the console semaphore before reading vt_newvt. Signed-off-by: Samuel Ortiz <sa...@op...> Signed-off-by: Antonino Daplas <ad...@gm...> --- drivers/char/vt_ioctl.c | 8 +++++--- 1 files changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/char/vt_ioctl.c b/drivers/char/vt_ioctl.c index 60111a7..c872774 100644 --- a/drivers/char/vt_ioctl.c +++ b/drivers/char/vt_ioctl.c @@ -812,6 +812,7 @@ #endif /* * Switching-from response */ + acquire_console_sem(); if (vc->vt_newvt >= 0) { if (arg == 0) /* @@ -826,7 +827,6 @@ #endif * complete the switch. */ int newvt; - acquire_console_sem(); newvt = vc->vt_newvt; vc->vt_newvt = -1; i = vc_allocate(newvt); @@ -840,7 +840,6 @@ #endif * other console switches.. */ complete_change_console(vc_cons[newvt].d); - release_console_sem(); } } @@ -852,9 +851,12 @@ #endif /* * If it's just an ACK, ignore it */ - if (arg != VT_ACKACQ) + if (arg != VT_ACKACQ) { + release_console_sem(); return -EINVAL; + } } + release_console_sem(); return 0; |