From owner-cvs-src@FreeBSD.ORG Fri Sep 29 19:54:04 2006 Return-Path: X-Original-To: cvs-src@FreeBSD.org Delivered-To: cvs-src@FreeBSD.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 0B96116A412; Fri, 29 Sep 2006 19:54:04 +0000 (UTC) (envelope-from bde@zeta.org.au) Received: from mailout2.pacific.net.au (mailout2-3.pacific.net.au [61.8.2.226]) by mx1.FreeBSD.org (Postfix) with ESMTP id 96CFB43D45; Fri, 29 Sep 2006 19:54:03 +0000 (GMT) (envelope-from bde@zeta.org.au) Received: from mailproxy2.pacific.net.au (mailproxy2.pacific.net.au [61.8.2.163]) by mailout2.pacific.net.au (Postfix) with ESMTP id 2D24F10B2F1; Sat, 30 Sep 2006 05:54:02 +1000 (EST) Received: from katana.zip.com.au (katana.zip.com.au [61.8.7.246]) by mailproxy2.pacific.net.au (8.13.4/8.13.4/Debian-3sarge3) with ESMTP id k8TJrxKt009619; Sat, 30 Sep 2006 05:54:00 +1000 Date: Sat, 30 Sep 2006 05:53:58 +1000 (EST) From: Bruce Evans X-X-Sender: bde@delplex.bde.org To: Martin Blapp In-Reply-To: <20060929202338.W91466@godot.imp.ch> Message-ID: <20060930044711.H96144@delplex.bde.org> References: <200609290952.k8T9qvcU053566@repoman.freebsd.org> <20060929202338.W91466@godot.imp.ch> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Cc: cvs-src@FreeBSD.org, Martin Blapp , cvs-all@FreeBSD.org, src-committers@FreeBSD.org Subject: Re: cvs commit: src/sys/kern tty_pty.c X-BeenThere: cvs-src@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: CVS commit messages for the src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Sep 2006 19:54:04 -0000 On Fri, 29 Sep 2006, Martin Blapp wrote: >> Free tty struct after last close. This should fix the pty-leak by numbers. >> Remove workarounds for tty_refcount beeing 0, this will be fixed >> differently >> later. >> >> Back out rev 1.145 since we initialize the tty struct from scratch and bad >> things can't happen anymore. > > Sigh. Peter Holmes stress tests did show that we still have problems. With > the beckout of rev. 1.145 we get again the same panics as the pty_pts code > does. > This is deep somewhere in the devfs code. It does happen with/without freeing > struct tty. > > Memory modified after free 0xc45b7d00(252) val=deadc0dd @ 0xc45b7d70 > panic: Most recently used by DEVFS1 > ... I think I found the bug while looking for problems near vgonel(). We're nowhere near ready to free devices in in last-close, since vgonel() doesn't do anything to evict processes from device functions before it forces the device closed. Drivers must be aware of the problem. The tty driver already is. See the comments about t_gen near tty_close() and ttysleep(). t_gen must live across close so that any processes in device functions can check it after they wake up, and the tty and device data structures must live across last- close to hold t_gen and anything else needed for the device functions to return. Sleeping device functions normally wake up after last-close returns. Bruce