Firstly, I've proven my original suspicions about tty hangup wrong.
However, I'm concerned that we don't have sufficient locking present
(even in 2.4) to ensure that unloading tty driver modules is safe by
The first point where we obtain a driver structure is under the
BKL in tty_io.c:init_dev(), which calls get_tty_driver().
get_tty_driver() searches a list of drivers for the relevant
entry. There are no locks here.
Now, consider tty_unregister_driver(). This is normally called from
a tty driver modules cleanup function. Also note that there are no
Also consider tty_register_driver() and note, again, that there are
no locks here.
Checking kernel/module.c, the BKL isn't held when calling the modules
init and cleanup functions.
So, all in all, we have a nice SMP race between loading tty driver
modules, unloading tty driver modules, and getting reference counts
on driver modules.
Since tty_register_driver() and tty_unregister_driver() are both
called from process context, the fix can be a semaphore. However,
note carefully that any semaphore that can sleep in the open path
will drop the BKL and therefore could cause other races (wrt
-- Russell King (email@example.com) The developer of ARM Linux http://www.arm.linux.org.uk/personal/aboutme.html
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to firstname.lastname@example.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/