From owner-svn-src-stable-6@FreeBSD.ORG Wed Oct 22 15:28:00 2008 Return-Path: Delivered-To: svn-src-stable-6@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 49A25106566B; Wed, 22 Oct 2008 15:28:00 +0000 (UTC) (envelope-from jhb@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c]) by mx1.freebsd.org (Postfix) with ESMTP id 368AA8FC0A; Wed, 22 Oct 2008 15:28:00 +0000 (UTC) (envelope-from jhb@FreeBSD.org) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.3/8.14.3) with ESMTP id m9MFS0wV032143; Wed, 22 Oct 2008 15:28:00 GMT (envelope-from jhb@svn.freebsd.org) Received: (from jhb@localhost) by svn.freebsd.org (8.14.3/8.14.3/Submit) id m9MFS04p032142; Wed, 22 Oct 2008 15:28:00 GMT (envelope-from jhb@svn.freebsd.org) Message-Id: <200810221528.m9MFS04p032142@svn.freebsd.org> From: John Baldwin Date: Wed, 22 Oct 2008 15:28:00 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-6@freebsd.org X-SVN-Group: stable-6 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: Subject: svn commit: r184165 - in stable/6/sys: . kern X-BeenThere: svn-src-stable-6@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: SVN commit messages for only the 6-stable src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Oct 2008 15:28:00 -0000 Author: jhb Date: Wed Oct 22 15:27:59 2008 New Revision: 184165 URL: http://svn.freebsd.org/changeset/base/184165 Log: MFC: Close a race in the kern.ttys sysctl handler that resulted in panics in dev2udev() when a tty was being detached concurrently with the sysctl handler. One difference relative to 7.x+ is that we still leak tty objects in tty_free() since destroy_dev() in 6.x doesn't purge all threads. Approved by: re (kib) Modified: stable/6/sys/ (props changed) stable/6/sys/kern/tty.c Modified: stable/6/sys/kern/tty.c ============================================================================== --- stable/6/sys/kern/tty.c Wed Oct 22 15:00:22 2008 (r184164) +++ stable/6/sys/kern/tty.c Wed Oct 22 15:27:59 2008 (r184165) @@ -3024,16 +3024,19 @@ ttygone(struct tty *tp) * * XXX: This shall sleep until all threads have left the driver. */ - void ttyfree(struct tty *tp) { + struct cdev *dev; u_int unit; mtx_assert(&Giant, MA_OWNED); ttygone(tp); unit = tp->t_devunit; - destroy_dev(tp->t_mdev); + dev = tp->t_mdev; + dev->si_tty = NULL; + tp->t_dev = NULL; + destroy_dev(dev); free_unr(tty_unit, unit); } @@ -3049,8 +3052,9 @@ sysctl_kern_ttys(SYSCTL_HANDLER_ARGS) tp = TAILQ_FIRST(&tty_list); if (tp != NULL) ttyref(tp); - mtx_unlock(&tty_list_mutex); while (tp != NULL) { + if (tp->t_state & TS_GONE) + goto nexttp; bzero(&xt, sizeof xt); xt.xt_size = sizeof xt; #define XT_COPY(field) xt.xt_##field = tp->t_##field @@ -3058,6 +3062,18 @@ sysctl_kern_ttys(SYSCTL_HANDLER_ARGS) xt.xt_cancc = tp->t_canq.c_cc; xt.xt_outcc = tp->t_outq.c_cc; XT_COPY(line); + + /* + * XXX: We hold the tty list lock while doing this to + * work around a race with pty/pts tty destruction. + * They set t_dev to NULL and then call ttyrel() to + * free the structure which will block on the list + * lock before they call destroy_dev() on the cdev + * backing t_dev. + * + * XXX: ttyfree() now does the same since it has been + * fixed to not leak ttys. + */ if (tp->t_dev != NULL) xt.xt_dev = dev2udev(tp->t_dev); XT_COPY(state); @@ -3080,19 +3096,22 @@ sysctl_kern_ttys(SYSCTL_HANDLER_ARGS) XT_COPY(olowat); XT_COPY(ospeedwat); #undef XT_COPY + mtx_unlock(&tty_list_mutex); error = SYSCTL_OUT(req, &xt, sizeof xt); if (error != 0) { ttyrel(tp); return (error); } mtx_lock(&tty_list_mutex); - tp2 = TAILQ_NEXT(tp, t_list); +nexttp: tp2 = TAILQ_NEXT(tp, t_list); if (tp2 != NULL) ttyref(tp2); mtx_unlock(&tty_list_mutex); ttyrel(tp); tp = tp2; + mtx_lock(&tty_list_mutex); } + mtx_unlock(&tty_list_mutex); return (0); }