From owner-freebsd-stable@FreeBSD.ORG  Mon Jul  5 22:54:37 2010
Return-Path: <owner-freebsd-stable@FreeBSD.ORG>
Delivered-To: freebsd-stable@FreeBSD.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id C736D106566B
	for <freebsd-stable@FreeBSD.org>; Mon,  5 Jul 2010 22:54:37 +0000 (UTC)
	(envelope-from ed@hoeg.nl)
Received: from mx0.hoeg.nl (mx0.hoeg.nl [IPv6:2001:4dd0:ff41::b23f:aa])
	by mx1.freebsd.org (Postfix) with ESMTP id 8800B8FC16
	for <freebsd-stable@FreeBSD.org>; Mon,  5 Jul 2010 22:54:37 +0000 (UTC)
Received: by mx0.hoeg.nl (Postfix, from userid 1000)
	id DED5B2A29248; Tue,  6 Jul 2010 00:54:36 +0200 (CEST)
Date: Tue, 6 Jul 2010 00:54:36 +0200
From: Ed Schouten <ed@80386.nl>
To: Jeremie Le Hen <jeremie@le-hen.org>
Message-ID: <20100705225436.GL2179@hoeg.nl>
References: <20100705185019.GB6194@felucia.tataz.chchile.org>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature"; boundary="xVNRhe5Alm/fDnuT"
Content-Disposition: inline
In-Reply-To: <20100705185019.GB6194@felucia.tataz.chchile.org>
User-Agent: Mutt/1.5.20 (2009-06-14)
Cc: freebsd-stable@FreeBSD.org
Subject: Re: Panic in destroy_dev_sched_cb() for tty
X-BeenThere: freebsd-stable@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Production branch of FreeBSD source code <freebsd-stable.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>, 
	<mailto:freebsd-stable-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-stable>
List-Post: <mailto:freebsd-stable@freebsd.org>
List-Help: <mailto:freebsd-stable-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
	<mailto:freebsd-stable-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 05 Jul 2010 22:54:37 -0000


--xVNRhe5Alm/fDnuT
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

* Jeremie Le Hen <jeremie@le-hen.org> wrote:
> I've got a panic obviously from the tty layer but I couldn't get the
> panic string as no remote system was connected using serial console, and
> I don't know how to print it from DDB.

Hmmm... This is a tricky one, but I think I do understand what's going
on here. If you close and revoke a TTY at the very exact moment, it may
call destroy_dev_sched_cb() twice, where the second time it gets called
on a null pointer.

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
--- sys/kern/tty.c	(revision 209570)
+++ sys/kern/tty.c	(working copy)
@@ -1040,7 +1040,8 @@
 	tp->t_dev =3D NULL;
 	tty_unlock(tp);
=20
-	destroy_dev_sched_cb(dev, tty_dealloc, tp);
+	if (dev !=3D NULL)
+		destroy_dev_sched_cb(dev, tty_dealloc, tp);
 }
=20
 void

I guess it's very hard to reproduce, right? If so, I'll just commit it
to SVN. Thanks for reporting!

--=20
 Ed Schouten <ed@80386.nl>
 WWW: http://80386.nl/

--xVNRhe5Alm/fDnuT
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.15 (FreeBSD)

iEYEARECAAYFAkwyYqwACgkQ52SDGA2eCwWLWACbBTNIytx9SKVXHh5rjsrSsY/k
QAkAnR2I9ZCNH4pI8tAi/JViACbhKJYt
=5eo1
-----END PGP SIGNATURE-----

--xVNRhe5Alm/fDnuT--