Messages in this thread |  | | Date | Sun, 2 Aug 2009 22:05:14 +0300 | From | Sergey Senozhatsky <> | Subject | Re: WARNING at: drivers/char/tty_ldisc.c |
| |
On (08/02/09 10:16), Linus Torvalds wrote: > > Looks like we have one more bug in tty code: > > 'shutdown -r now' in 'single' user mode gives following trace: > > > > WARNING at: drivers/char/tty_ldisc.c:209 tty_ldisc_put+0x95/0xa0 > > --- > > warn_slowpath_common+0x78/0xa0 > > warn_slowpath_null+0x21/0x40 > > tty_ldisc_put+0x95/0xa0 > > tty_ldisc_hangup+0xfc/0x1f0 > > do_tty_hangup+0x131/0x380 > > disassociate_ctty+0x50/0x210 > > do_exit+0x6b8/0x700 > > do_group_exit+0x45/0xb0 > > get_signal_to_deliver+0x226/0x410 > > do_notify_resume+0xc1+0xa90 > > work_notifysig+0x13/0x19 > > > > //There is no trace in syslog, so given one is 'copy-paste' from the paper. > > We have that 'refcount' counter for the ldisc, but we don't actually use > it for memory management like we should (ie "free the ldisc when count > goes to zero"), we just decrement it and free the thing. > > And it's quite possible that another CPU is doing some tty read thing or > other that does > > tty_ldisc_try(..) // increments ld->refcount > ... > tty_ldisc_deref(..) // decrements it. > > at the same time. >
non-SMP system 'fails' as well.
> The ldisc refcounts are simply done wrong. They are more debugging aids > (for the case where no races occur), than actual memory management > refcounts. > tty_ldisc.c:798 tty_ldisc_hangup WARN_ON(tty_ldisc_wait_idle(tty) != 0);
gave WARN_ON traces.
So, it seems refcount is wrong before tty_ldisc_halt(tty); tty_ldisc_wait_idle(tty);
/* which is */ if (wait_event_timeout(tty_ldisc_wait, tty->ldisc->refcount == 0, 5 * HZ) == 0) return -EBUSY;
Sergey [unhandled content-type:application/pgp-signature] |  |