From owner-freebsd-stable@FreeBSD.ORG  Fri Jun 23 11:46:20 2006
Return-Path: <owner-freebsd-stable@FreeBSD.ORG>
X-Original-To: freebsd-stable@freebsd.org
Delivered-To: freebsd-stable@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id C0CB516A494;
	Fri, 23 Jun 2006 11:46:20 +0000 (UTC) (envelope-from mb@imp.ch)
Received: from pop.imp.ch (mx2.imp.ch [157.161.9.17])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 028F043D46;
	Fri, 23 Jun 2006 11:46:19 +0000 (GMT) (envelope-from mb@imp.ch)
Received: from godot.imp.ch (godot.imp.ch [157.161.4.8])
	by pop.imp.ch (8.13.7/8.13.7/Submit) with ESMTP id k5NBkEKP028063;
	Fri, 23 Jun 2006 13:46:17 +0200 (CEST) (envelope-from mb@imp.ch)
Date: Fri, 23 Jun 2006 13:46:14 +0200 (CEST)
From: Martin Blapp <mb@imp.ch>
To: Gavin Atkinson <gavin.atkinson@ury.york.ac.uk>
In-Reply-To: <1151056731.62769.2.camel@buffy.york.ac.uk>
Message-ID: <20060623133915.S14714@godot.imp.ch>
References: <20060621202508.S17514@godot.imp.ch>
	<20060621193941.Y8526@fledge.watson.org>
	<20060622205806.GA6542@FreeBSD.czest.pl>
	<20060622223630.V17514@godot.imp.ch>
	<1151056731.62769.2.camel@buffy.york.ac.uk>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
X-Scanned-By: MIMEDefang 2.57 on 157.161.9.65
Cc: Robert Watson <rwatson@freebsd.org>, Patrick Guelat <patg@imp.ch>,
	"Wojciech A. Koszek" <wkoszek@freebsd.org>, freebsd-stable@freebsd.org
Subject: Re: Crash with FreeBSD 6.1 STABLE of today
X-BeenThere: freebsd-stable@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Production branch of FreeBSD source code <freebsd-stable.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>, 
	<mailto:freebsd-stable-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-stable>
List-Post: <mailto:freebsd-stable@freebsd.org>
List-Help: <mailto:freebsd-stable-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
	<mailto:freebsd-stable-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 23 Jun 2006 11:46:20 -0000


Hi,

Maybe this is the solution ? IMHO there is a race window
open between the first tp->t_session test and the locking
of the proc tree.

Martin

+++ src/sys/kern/tty.c
--- src/sys/kern/tty.c

+                       sx_slock(&proctree_lock);
                         if (tp->t_session) {
-				sx_slock(&proctree_lock);
                                 if (tp->t_session->s_leader) {
                                         struct proc *p;

                                         p = tp->t_session->s_leader;
                                         PROC_LOCK(p);
                                         psignal(p, SIGHUP);
                                         PROC_UNLOCK(p);
                                 }
-				sx_sunlock(&proctree_lock);
                         }
+                       sx_sunlock(&proctree_lock);