From a64314e62d89562b6fc77593648bec3acc35bf61 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20L=C3=BCbbe?= Date: Sat, 29 Sep 2007 18:47:51 +0200 Subject: fix console change race exposed by CFS MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The new behaviour of CFS exposes a race which occurs if a switch is requested when vt_mode.mode is VT_PROCESS. The process with vc->vt_pid is signaled before vc->vt_newvt is set. This causes the switch to fail when triggered by the monitoing process because the target is still -1. [ If the signal sending fails, the subsequent "reset_vc(vc)" will then reset vt_newvt to -1, so this works for that case too. - Linus ] Signed-off-by: Jan Lübbe Signed-off-by: Linus Torvalds diff --git a/drivers/char/vt_ioctl.c b/drivers/char/vt_ioctl.c index c6f6f42..045e688 100644 --- a/drivers/char/vt_ioctl.c +++ b/drivers/char/vt_ioctl.c @@ -1208,15 +1208,18 @@ void change_console(struct vc_data *new_vc) /* * Send the signal as privileged - kill_pid() will * tell us if the process has gone or something else - * is awry + * is awry. + * + * We need to set vt_newvt *before* sending the signal or we + * have a race. */ + vc->vt_newvt = new_vc->vc_num; if (kill_pid(vc->vt_pid, vc->vt_mode.relsig, 1) == 0) { /* * It worked. Mark the vt to switch to and * return. The process needs to send us a * VT_RELDISP ioctl to complete the switch. */ - vc->vt_newvt = new_vc->vc_num; return; } -- cgit v0.10.2