From owner-freebsd-stable@FreeBSD.ORG Tue Jul 6 08:44:32 2010 Return-Path: Delivered-To: freebsd-stable@FreeBSD.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 29B12106566C for ; Tue, 6 Jul 2010 08:44:32 +0000 (UTC) (envelope-from jeremie@le-hen.org) Received: from smtp5-g21.free.fr (smtp5-g21.free.fr [212.27.42.5]) by mx1.freebsd.org (Postfix) with ESMTP id 926A28FC0A for ; Tue, 6 Jul 2010 08:44:29 +0000 (UTC) Received: from endor.tataz.chchile.org (unknown [82.233.239.98]) by smtp5-g21.free.fr (Postfix) with ESMTP id 42224D4807B; Tue, 6 Jul 2010 10:44:24 +0200 (CEST) Received: from felucia.tataz.chchile.org (felucia.tataz.chchile.org [192.168.1.9]) by endor.tataz.chchile.org (Postfix) with ESMTP id A1D1A33E60; Tue, 6 Jul 2010 08:44:22 +0000 (UTC) Received: by felucia.tataz.chchile.org (Postfix, from userid 1000) id 92EF8A1117; Tue, 6 Jul 2010 08:44:22 +0000 (UTC) Date: Tue, 6 Jul 2010 10:44:22 +0200 From: Jeremie Le Hen To: Ed Schouten Message-ID: <20100706084422.GC6194@felucia.tataz.chchile.org> References: <20100705185019.GB6194@felucia.tataz.chchile.org> <20100705225436.GL2179@hoeg.nl> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20100705225436.GL2179@hoeg.nl> User-Agent: Mutt/1.5.20 (2009-06-14) Cc: freebsd-stable@FreeBSD.org, Jeremie Le Hen Subject: Re: Panic in destroy_dev_sched_cb() for tty X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Jul 2010 08:44:32 -0000 On Tue, Jul 06, 2010 at 12:54:36AM +0200, Ed Schouten wrote: > * Jeremie Le Hen wrote: > > I've got a panic obviously from the tty layer but I couldn't get the > > panic string as no remote system was connected using serial console, and > > I don't know how to print it from DDB. > > Hmmm... This is a tricky one, but I think I do understand what's going > on here. If you close and revoke a TTY at the very exact moment, it may > call destroy_dev_sched_cb() twice, where the second time it gets called > on a null pointer. > > =================================================================== > --- sys/kern/tty.c (revision 209570) > +++ sys/kern/tty.c (working copy) > @@ -1040,7 +1040,8 @@ > tp->t_dev = NULL; > tty_unlock(tp); > > - destroy_dev_sched_cb(dev, tty_dealloc, tp); > + if (dev != NULL) > + destroy_dev_sched_cb(dev, tty_dealloc, tp); > } > > void > > I guess it's very hard to reproduce, right? If so, I'll just commit it > to SVN. Thanks for reporting! Sure it is. I use screen heavily and this is the first time I get it. Please go forward, I will update my kernel after it has been MFC and I won't miss informing you if it occurs again. Regards, -- Jeremie Le Hen Humans are born free and equal. But some are more equal than others. Coluche