)]}'
{
  "commit": "e2efafbf139d2bfdfe96f2901f03189fecd172e4",
  "tree": "252ebbb93326f159890b6e1370a909b6ced72c0a",
  "parents": [
    "6a20bd45fda271bd57e3ba41b3de3009797f4b5e"
  ],
  "author": {
    "name": "Jiri Slaby",
    "email": "jslaby@suse.cz",
    "time": "Mon Nov 29 10:16:53 2010 +0100"
  },
  "committer": {
    "name": "Greg Kroah-Hartman",
    "email": "gregkh@suse.de",
    "time": "Mon Nov 29 14:52:48 2010 -0800"
  },
  "message": "TTY: don\u0027t allow reopen when ldisc is changing\n\nThere are many WARNINGs like the following reported nowadays:\nWARNING: at drivers/tty/tty_io.c:1331 tty_open+0x2a2/0x49a()\nHardware name: Latitude E6500\nModules linked in:\nPid: 1207, comm: plymouthd Not tainted 2.6.37-rc3-mmotm1123 #3\nCall Trace:\n [\u003cffffffff8103b189\u003e] warn_slowpath_common+0x80/0x98\n [\u003cffffffff8103b1b6\u003e] warn_slowpath_null+0x15/0x17\n [\u003cffffffff8128a3ab\u003e] tty_open+0x2a2/0x49a\n [\u003cffffffff810fd53f\u003e] chrdev_open+0x11d/0x146\n...\n\nThis means tty_reopen is called without TTY_LDISC set. For further\nconsiderations, note tty_lock is held in tty_open. TTY_LDISC is cleared in:\n1) __tty_hangup from tty_ldisc_hangup to tty_ldisc_enable. During this\nsection tty_lock is held. However tty_lock is temporarily dropped in\nthe middle of the function by tty_ldisc_hangup.\n\n2) tty_release via tty_ldisc_release till the end of tty existence. If\ntty-\u003ecount \u003c\u003d 1, tty_lock is taken, TTY_CLOSING bit set and then\ntty_ldisc_release called. tty_reopen checks TTY_CLOSING before checking\nTTY_LDISC.\n\n3) tty_set_ldisc from tty_ldisc_halt to tty_ldisc_enable. We:\n   * take tty_lock, set TTY_LDISC_CHANGING, put tty_lock\n   * call tty_ldisc_halt (clear TTY_LDISC), tty_lock is _not_ held\n   * do some other work\n   * take tty_lock, call tty_ldisc_enable (set TTY_LDISC), put\n     tty_lock\n\nI cannot see how 2) can be a problem, as there I see no race. OTOH, 1)\nand 3) can happen without problems. This patch the case 3) by checking\nTTY_LDISC_CHANGING along with TTY_CLOSING in tty_reopen. 1) will be\nfixed in the following patch.\n\nNicely reproducible with two processes:\nwhile (1) {\n\tfd \u003d open(\"/dev/ttyS1\", O_RDWR);\n\tif (fd \u003c 0) {\n\t\twarn(\"open\");\n\t\tcontinue;\n\t}\n\tclose(fd);\n}\n--------\nwhile (1) {\n        fd \u003d open(\"/dev/ttyS1\", O_RDWR);\n        ld1 \u003d 0; ld2 \u003d 2;\n        while (1) {\n                ioctl(fd, TIOCSETD, \u0026ld1);\n                ioctl(fd, TIOCSETD, \u0026ld2);\n        }\n        close(fd);\n}\n\nSigned-off-by: Jiri Slaby \u003cjslaby@suse.cz\u003e\nReported-by: \u003cValdis.Kletnieks@vt.edu\u003e\nCc: Kyle McMartin \u003ckyle@mcmartin.ca\u003e\nCc: Alan Cox \u003calan@lxorguk.ukuu.org.uk\u003e\nCc: stable \u003cstable@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "c05c5af5aa044029561e38de9683e12a26c0c0c4",
      "old_mode": 33188,
      "old_path": "drivers/tty/tty_io.c",
      "new_id": "878f6d667b1744aaf90be87a50da56e919413ad4",
      "new_mode": 33188,
      "new_path": "drivers/tty/tty_io.c"
    }
  ]
}