Check tty_gone() after allocating IO buffers. The tty lock has to be

dropped then reacquired due to using M_WAITOK, which opens a window in
which the tty device can disappear.  Check for this and return ENXIO
back up the call chain so that callers can cope.

This closes a race where TF_GONE would get set while buffers were being
allocated as part of ttydev_open(), causing a subsequent call to
ttydevsw_modem() later in ttydev_open() to assert.

Reported by:	pho
Reviewed by:	kib

1 files changed, 2 insertions, 2 deletions

diff --git a/sys/sys/ttyqueue.h b/sys/sys/ttyqueue.h
index 2d1a565af965..c8d85d6280d5 100644
--- a/sys/sys/ttyqueue.h
+++ b/sys/sys/ttyqueue.h
@@ -69,7 +69,7 @@ struct ttyoutq {
 
 #ifdef _KERNEL
 /* Input queue handling routines. */
-void	ttyinq_setsize(struct ttyinq *ti, struct tty *tp, size_t len);
+int	ttyinq_setsize(struct ttyinq *ti, struct tty *tp, size_t len);
 void	ttyinq_free(struct ttyinq *ti);
 int	ttyinq_read_uio(struct ttyinq *ti, struct tty *tp, struct uio *uio,
     size_t readlen, size_t flushlen);
@@ -136,7 +136,7 @@ void	ttyinq_line_iterate_from_reprintpos(struct ttyinq *ti,
 
 /* Output queue handling routines. */
 void	ttyoutq_flush(struct ttyoutq *to);
-void	ttyoutq_setsize(struct ttyoutq *to, struct tty *tp, size_t len);
+int	ttyoutq_setsize(struct ttyoutq *to, struct tty *tp, size_t len);
 void	ttyoutq_free(struct ttyoutq *to);
 size_t	ttyoutq_read(struct ttyoutq *to, void *buf, size_t len);
 int	ttyoutq_read_uio(struct ttyoutq *to, struct tty *tp, struct uio *uio);