From owner-svn-src-all@FreeBSD.ORG Sun Sep 28 21:25:59 2014 Return-Path: Delivered-To: svn-src-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id C8A1B5BD; Sun, 28 Sep 2014 21:25:59 +0000 (UTC) Received: from mail-pa0-x236.google.com (mail-pa0-x236.google.com [IPv6:2607:f8b0:400e:c03::236]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 8D2E8AA7; Sun, 28 Sep 2014 21:25:59 +0000 (UTC) Received: by mail-pa0-f54.google.com with SMTP id ey11so4728673pad.13 for ; Sun, 28 Sep 2014 14:25:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=references:mime-version:in-reply-to:content-type :content-transfer-encoding:message-id:cc:from:subject:date:to; bh=2n1NNx+I6SwVQeg3iqH9NvmekgrXszTQYzB8kZvRwtE=; b=cIqGEcO9sYMQ2VhYSUIAbpoeeU61rcqET0H2Unie4yMgDOzXngnlx5+6v92vB88I8y 2IfoN2WcPBuJQF9PkcNxXxYOW8qpbckzDHsx1a+UehXLGVZYOImdoc8geHh2ZcGbkf2f +JGpqej+/d1hAsybjQrp+MN7aFkW69hri1exvBpRWWbYT4mlzSKEu4932+zmoizJwfjl TzJ89YTZtz4bi5HEhpmN1jfW4cxBVCE3kMDB6aJHATWHHGg5kwntsqTyhdgWcLFrS8Yu /2RxieROcg2QfOyxcfO3sV0mbnxJmDQuC0tZX9PfpArOFBkUmHTe54J+ubh7EjvE93Hz l+bA== X-Received: by 10.68.197.65 with SMTP id is1mr53239109pbc.125.1411939559190; Sun, 28 Sep 2014 14:25:59 -0700 (PDT) Received: from [192.168.20.11] (c-98-247-240-204.hsd1.wa.comcast.net. [98.247.240.204]) by mx.google.com with ESMTPSA id qs4sm10417079pbb.90.2014.09.28.14.25.58 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Sun, 28 Sep 2014 14:25:58 -0700 (PDT) References: <201409282112.s8SLCNuA067731@svn.freebsd.org> Mime-Version: 1.0 (1.0) In-Reply-To: <201409282112.s8SLCNuA067731@svn.freebsd.org> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Message-Id: X-Mailer: iPhone Mail (11D257) From: Garrett Cooper Subject: Re: svn commit: r272270 - head/sys/kern Date: Sun, 28 Sep 2014 14:25:56 -0700 To: Neel Natu Cc: "svn-src-head@freebsd.org" , "svn-src-all@freebsd.org" , "src-committers@freebsd.org" X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 28 Sep 2014 21:25:59 -0000 Hi Neel! Thank you for fixing this. I think we've run into similar issues with cu= stomizations to the tty code at Isilon. I have one comment... Thanks! > On Sep 28, 2014, at 14:12, Neel Natu wrote: >=20 > Author: neel > Date: Sun Sep 28 21:12:23 2014 > New Revision: 272270 > URL: http://svnweb.freebsd.org/changeset/base/272270 >=20 > Log: > tty_rel_free() can be called more than once for the same tty so make sure= > that the tty is dequeued from 'tty_list' only the first time. >=20 > The panic below was seen when a revoke(2) was issued on an nmdm device. > In this case there was also a thread that was blocked on a read(2) on the= > device. The revoke(2) woke up the blocked thread which would typically > return an error to userspace. In this case the reader also held the last > reference on the file descriptor so fdrop() ended up calling tty_rel_free= () > via ttydev_close(). >=20 > tty_rel_free() then tried to dequeue 'tp' again which led to the panic. >=20 > panic: Bad link elm 0xfffff80042602400 prev->next !=3D elm > cpuid =3D 1 > KDB: stack backtrace: > db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe00f9c= 90460 > kdb_backtrace() at kdb_backtrace+0x39/frame 0xfffffe00f9c90510 > vpanic() at vpanic+0x189/frame 0xfffffe00f9c90590 > panic() at panic+0x43/frame 0xfffffe00f9c905f0 > tty_rel_free() at tty_rel_free+0x29b/frame 0xfffffe00f9c90640 > ttydev_close() at ttydev_close+0x1f9/frame 0xfffffe00f9c90690 > devfs_close() at devfs_close+0x298/frame 0xfffffe00f9c90720 > VOP_CLOSE_APV() at VOP_CLOSE_APV+0x13c/frame 0xfffffe00f9c90770 > vn_close() at vn_close+0x194/frame 0xfffffe00f9c90810 > vn_closefile() at vn_closefile+0x48/frame 0xfffffe00f9c90890 > devfs_close_f() at devfs_close_f+0x2c/frame 0xfffffe00f9c908c0 > _fdrop() at _fdrop+0x29/frame 0xfffffe00f9c908e0 > sys_read() at sys_read+0x63/frame 0xfffffe00f9c90980 > amd64_syscall() at amd64_syscall+0x2b3/frame 0xfffffe00f9c90ab0 > Xfast_syscall() at Xfast_syscall+0xfb/frame 0xfffffe00f9c90ab0 > --- syscall (3, FreeBSD ELF64, sys_read), rip =3D 0x800b78d8a, rsp =3D 0x= 7fffffbfdaf8, rbp =3D 0x7fffffbfdb30 --- >=20 > CR: https://reviews.freebsd.org/D851 > Reviewed by: glebius, ed > Reported by: Leon Dang > Sponsored by: Nahanni Systems > MFC after: 1 week >=20 > Modified: > head/sys/kern/tty.c >=20 > Modified: head/sys/kern/tty.c > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D > --- head/sys/kern/tty.c Sun Sep 28 20:06:02 2014 (r272269) > +++ head/sys/kern/tty.c Sun Sep 28 21:12:23 2014 (r272270) > @@ -1055,13 +1055,13 @@ tty_rel_free(struct tty *tp) > tp->t_dev =3D NULL; > tty_unlock(tp); >=20 > - sx_xlock(&tty_list_sx); > - TAILQ_REMOVE(&tty_list, tp, t_list); > - tty_list_count--; > - sx_xunlock(&tty_list_sx); > - > - if (dev !=3D NULL) > + if (dev !=3D NULL) { if (dev =3D=3D NULL) return; Would be result in less change in an MFC. > + sx_xlock(&tty_list_sx); > + TAILQ_REMOVE(&tty_list, tp, t_list); > + tty_list_count--; > + sx_xunlock(&tty_list_sx); > destroy_dev_sched_cb(dev, tty_dealloc, tp); > + } > } >=20 > void