diff options
| author | Todd C. Miller <millert@cvs.openbsd.org> | 2005-11-21 01:16:03 +0000 |
|---|---|---|
| committer | Todd C. Miller <millert@cvs.openbsd.org> | 2005-11-21 01:16:03 +0000 |
| commit | 30c294805419e4344345ed32065a7946679afa25 (patch) | |
| tree | 788a15205984978467f961ab83fcb2162ff4af8d | |
| parent | 06efaa9e82041caaa29c02b9d8e2ee5a53537e5c (diff) | |
Fix a crash in ptmioctl() in the error path when the master has
been opened but the slave cannot be. We can't do the FILE_SET_MATURE
until we are past all possible error paths since it calls FRELE(),
resulting in a reference count of 0, which closef() panics on #ifdef
DIAGNOSTIC. OK deraadt@
| -rw-r--r-- | sys/kern/tty_pty.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/sys/kern/tty_pty.c b/sys/kern/tty_pty.c index f39aafb321c..73d5f7c60c1 100644 --- a/sys/kern/tty_pty.c +++ b/sys/kern/tty_pty.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tty_pty.c,v 1.29 2005/05/26 00:33:45 pedro Exp $ */ +/* $OpenBSD: tty_pty.c,v 1.30 2005/11/21 01:16:02 millert Exp $ */ /* $NetBSD: tty_pty.c,v 1.33.4.1 1996/06/02 09:08:11 mrg Exp $ */ /* @@ -1175,7 +1175,6 @@ retry: cfp->f_ops = &vnops; cfp->f_data = (caddr_t) cnd.ni_vp; VOP_UNLOCK(cnd.ni_vp, 0, p); - FILE_SET_MATURE(cfp); /* * Open the slave. @@ -1229,7 +1228,6 @@ retry: sfp->f_ops = &vnops; sfp->f_data = (caddr_t) snd.ni_vp; VOP_UNLOCK(snd.ni_vp, 0, p); - FILE_SET_MATURE(sfp); /* now, put the indexen and names into struct ptmget */ ptm->cfd = cindx; @@ -1237,6 +1235,10 @@ retry: memcpy(ptm->cn, pti->pty_pn, sizeof(pti->pty_pn)); memcpy(ptm->sn, pti->pty_sn, sizeof(pti->pty_sn)); + /* mark the files mature now that we've passed all errors */ + FILE_SET_MATURE(cfp); + FILE_SET_MATURE(sfp); + fdpunlock(fdp); break; default: |