[lkml]   [2012]   [Mar]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRE: [PATCH] tty: hold lock across tty buffer finding and buffer filling
    The tty structure is protect and not null, the tty->buf.tail is null. Many people think the tty reference count isn't protected and cause this bug, it is not true. :-)

    For the flush case, it need acquire the spinlock to free the buffer and put buf.tail to NULL. So this patch will help:

    Here is the example place, you can see the __tty_buffer_flush is inside the spinlock.

    void tty_buffer_flush(struct tty_struct *tty)
    unsigned long flags;
    spin_lock_irqsave(&tty->buf.lock, flags);

    /* If the data is being pushed to the tty layer then we can't
    process it here. Instead set a flag and the flush_to_ldisc
    path will process the flush request before it exits */
    if (test_bit(TTY_FLUSHING, &tty->flags)) {
    set_bit(TTY_FLUSHPENDING, &tty->flags);
    spin_unlock_irqrestore(&tty->buf.lock, flags);
    test_bit(TTY_FLUSHPENDING, &tty->flags) == 0);
    } else
    spin_unlock_irqrestore(&tty->buf.lock, flags);


    -----Original Message-----
    From: Jiri Slaby [] On Behalf Of Jiri Slaby
    Sent: Friday, March 16, 2012 5:44 PM
    To: Du, Alek
    Cc: Alan Cox; Tu, Xiaobing;;; Zhang, Yanmin; Zuo, Jiao; Jiri Slaby
    Subject: Re: [PATCH] tty: hold lock across tty buffer finding and buffer filling

    On 03/15/2012 11:14 AM, Du, Alek wrote:
    > Alan,
    > I agree with you for the case of multiple writers to the tty buffer.
    > But there is another case that cause kernel hang: driver is writing data to tty, while app shutdown the port or flush through IOCTL. The buf.tail is set to NULL, here is the log:
    > <1>[ 4713.451954] BUG: unable to handle kernel NULL pointer
    > dereference at
    > 00000004

    The trace only suggests that you don't increment tty reference count in irq properly. If you did that, you would not have tty buffer gone by concurrent shutdown.

    For the latter case (flush via ioctl), your patch won't help for tty_prepare_string*, as we return pointer to the buffer which is freed by the flush, right?

    suse labs

     \ /
      Last update: 2012-03-16 10:51    [W:0.038 / U:5.980 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site