From owner-freebsd-stable@FreeBSD.ORG  Tue May  3 05:43:31 2005
Return-Path: <owner-freebsd-stable@FreeBSD.ORG>
Delivered-To: freebsd-stable@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id E9A3816A4CE; Tue,  3 May 2005 05:43:30 +0000 (GMT)
Received: from carver.gumbysoft.com (carver.gumbysoft.com [66.220.23.50])
	by mx1.FreeBSD.org (Postfix) with ESMTP
	id CD36243D88; Tue,  3 May 2005 05:43:30 +0000 (GMT)
	(envelope-from dwhite@gumbysoft.com)
Received: by carver.gumbysoft.com (Postfix, from userid 1000)
	id C197372DD4; Mon,  2 May 2005 22:43:30 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1])
	by carver.gumbysoft.com (Postfix) with ESMTP id BFE2272DCB;
	Mon,  2 May 2005 22:43:30 -0700 (PDT)
Date: Mon, 2 May 2005 22:43:30 -0700 (PDT)
From: Doug White <dwhite@gumbysoft.com>
To: freebsd-stable@freebsd.org
Message-ID: <20050502222223.P19845@carver.gumbysoft.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
cc: re@freebsd.org
Subject: Experimental ttwwakeup() panic patch
X-BeenThere: freebsd-stable@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Production branch of FreeBSD source code
	<freebsd-stable.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
	<mailto:freebsd-stable-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-stable>
List-Post: <mailto:freebsd-stable@freebsd.org>
List-Help: <mailto:freebsd-stable-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
	<mailto:freebsd-stable-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 03 May 2005 05:43:31 -0000

Hey folks,

I've taken a crack at working around the ttwwakeup() panic thats been
reported now and again.  My early analysis, based on debugging output from
rwatson, is that a defunct struct tty gets reused without cleaning out the
associated (stale) knote structures, and the ttwwakeup() at the end of
sioopen() jumps off into space when it finds them.

This patch is against RELENG_5 but the logic should apply to -CURRENT,
although the patch likely won't as ttymalloc() is organized differently
there.

I did some basic testing on my UP box and didn't see any abberant behavior
afterwards. However I can't reproduce the panic in question, so if you're
good at triggering the panic give this a spin.

http://people.freebsd.org/~dwhite/tty.c.20050502.patch

-- 
Doug White                    |  FreeBSD: The Power to Serve
dwhite@gumbysoft.com          |  www.FreeBSD.org