HomeFreeBSD

tty: do not recurse on ttydev_close()

Description

tty: do not recurse on ttydev_close()

When the terminal cdev is closed due to revoke, ttydev_close() destroys
t_inpoll and t_outpoll selinfos. Since corresponding knotes reference
files pointing to the same tty cdev, it fdrop()s them. But then the
VOP_CLOSE() call would recurse into the ttydev_close() for the same tty.
More, because the devfs vnode is already doomed, each close call gets
the FREVOKE flag set.

As result, the kernel is recursing as deep into the ttydev_close() as
there are opened files referencing the same tty, which have the knotes
installed. Basically, the recursion level is controlled by userspace.

Prevent it by marking the tty that is handled by ttydev_close(), with
the TF_INDEVCLOSE flag. Do nothing in ttydev_close() when the flag is
already set, avoiding recursion.

Fixes: acd5638e268a ("tty: delete knotes when TTY is revoked")
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58706

Details

Provenance
kibAuthored on Aug 7 2026, 7:48 PM
Reviewer
markj
Differential Revision
D58706: tty: do not recurse on ttydev_close()
Parents
rG17952b653256: vmm: fix compilation errors for static kernel on arm64
Branches
Unknown
Tags
Unknown