lkml.org 
[lkml]   [2009]   [Aug]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: WARNING at: drivers/char/tty_ldisc.c
On (08/02/09 10:16), Linus Torvalds wrote:
> > Looks like we have one more bug in tty code:
> > 'shutdown -r now' in 'single' user mode gives following trace:
> >
> > WARNING at: drivers/char/tty_ldisc.c:209 tty_ldisc_put+0x95/0xa0
> > ---
> > warn_slowpath_common+0x78/0xa0
> > warn_slowpath_null+0x21/0x40
> > tty_ldisc_put+0x95/0xa0
> > tty_ldisc_hangup+0xfc/0x1f0
> > do_tty_hangup+0x131/0x380
> > disassociate_ctty+0x50/0x210
> > do_exit+0x6b8/0x700
> > do_group_exit+0x45/0xb0
> > get_signal_to_deliver+0x226/0x410
> > do_notify_resume+0xc1+0xa90
> > work_notifysig+0x13/0x19
> >
> > //There is no trace in syslog, so given one is 'copy-paste' from the paper.
>
> We have that 'refcount' counter for the ldisc, but we don't actually use
> it for memory management like we should (ie "free the ldisc when count
> goes to zero"), we just decrement it and free the thing.
>
> And it's quite possible that another CPU is doing some tty read thing or
> other that does
>
> tty_ldisc_try(..) // increments ld->refcount
> ...
> tty_ldisc_deref(..) // decrements it.
>
> at the same time.
>

non-SMP system 'fails' as well.


> The ldisc refcounts are simply done wrong. They are more debugging aids
> (for the case where no races occur), than actual memory management
> refcounts.
>
tty_ldisc.c:798 tty_ldisc_hangup
WARN_ON(tty_ldisc_wait_idle(tty) != 0);

gave WARN_ON traces.

So, it seems refcount is wrong before
tty_ldisc_halt(tty);
tty_ldisc_wait_idle(tty);

/* which is */
if (wait_event_timeout(tty_ldisc_wait,
tty->ldisc->refcount == 0, 5 * HZ) == 0)
return -EBUSY;

Sergey
[unhandled content-type:application/pgp-signature]
\
 
 \ /
  Last update: 2009-08-02 21:05    [W:0.065 / U:6.148 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site