Date: Tue, 14 Nov 2006 22:22:43 +0800 (CST) From: Tai-hwa Liang <avatar@mmlab.cse.yzu.edu.tw> To: Giorgos Keramidas <keramida@freebsd.org> Cc: Tor Egge <tegge@freebsd.org>, cvs-src@freebsd.org, Martin Blapp <mb@imp.ch>, src-committers@freebsd.org, cvs-all@freebsd.org Subject: Re: cvs commit: src/sys/kern kern_conf.c Message-ID: <0611142157336.5368@www.mmlab.cse.yzu.edu.tw> In-Reply-To: <20061019000424.GA1262@gothmog.pc> References: <200610132049.k9DKnObw045731@repoman.freebsd.org> <20061015091459.V72308@godot.imp.ch> <20061018234916.GA1711@gothmog.pc> <20061019000424.GA1262@gothmog.pc>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, 19 Oct 2006, Giorgos Keramidas wrote: > FWIW, reverting revision 1.199 of kern_conf.c locally fixes the > unkillable xterms, stuck in "devdrn", problem. With rev 1.199, modules that do destroy_dev() in their d_close() will hang in "devdrn" state upon device closing. For example, netsmb and snp: # mount_smbfs -I server //server/share /mnt Password: [hang] # watch Snoop started. Enter device name []:^C [hang] It turns out that devfs_close() does a dev_refthread() before invoking device specific d_close(), which makes subsequent destroy_dev() being blocked in the "devdrn" loop. Before someone teaches these drivers not doing destroy_dev() in their d_close(), following bandaid can workaround this hanging problem: Index: sys/netsmb/smb_dev.c =================================================================== RCS file: /home/ncvs/src/sys/netsmb/smb_dev.c,v retrieving revision 1.29 diff -u -p -u -r1.29 smb_dev.c --- sys/netsmb/smb_dev.c 22 Nov 2005 02:15:46 -0000 1.29 +++ sys/netsmb/smb_dev.c 14 Nov 2006 13:49:37 -0000 @@ -175,6 +175,7 @@ nsmb_dev_close(struct cdev *dev, int fla */ dev->si_drv1 = NULL; free(sdp, M_NSMBDEV); + dev_relthread(dev); /* XXX dealing with si_threadcount */ destroy_dev(dev); splx(s); return 0; Index: sys/dev/snp/snp.c =================================================================== RCS file: /home/ncvs/src/sys/dev/snp/snp.c,v retrieving revision 1.102 diff -u -p -u -r1.102 snp.c --- sys/dev/snp/snp.c 19 Sep 2005 13:48:45 -0000 1.102 +++ sys/dev/snp/snp.c 14 Nov 2006 13:49:37 -0000 @@ -489,6 +489,7 @@ snpclose(dev, flags, fmt, td) free(snp->snp_buf, M_SNP); snp->snp_flags &= ~SNOOP_OPEN; dev->si_drv1 = NULL; + dev_relthread(dev); /* XXX dealing with si_threadcount */ destroy_dev(dev); return (snp_detach(snp)); On the other hand, si_threadcount could be negative with aforementioned patch... :( > On 2006-10-19 02:49, Giorgos Keramidas <keramida@freebsd.org> wrote: >> >> Maybe it's not related, but all xterm's seem unkillable and blocked >> forever in "devdrn" here, in a build from 2006.10.18.15.56.11. >> >> An earlier sync from 2006.10.13.12.45.54 didn't exhibit this behavior, >> so I guess there's something mildly buggy with this change? >> >> On 2006-10-15 09:15, Martin Blapp <mb@imp.ch> wrote: >>> >>> Cool, thank you ! >>> >>> Martin >>> >>> Martin Blapp, <mb@imp.ch> <mbr@FreeBSD.org> >>> ------------------------------------------------------------------ >>> ImproWare AG, UNIXSP & ISP, Zurlindenstrasse 29, 4133 Pratteln, CH >>> Phone: +41 61 826 93 00 Fax: +41 61 826 93 01 >>> PGP: <finger -l mbr@freebsd.org> >>> PGP Fingerprint: B434 53FC C87C FE7B 0A18 B84C 8686 EF22 D300 551E >>> ------------------------------------------------------------------ >>> >>> On Fri, 13 Oct 2006, Tor Egge wrote: >>> >>>> tegge 2006-10-13 20:49:24 UTC >>>> >>>> FreeBSD src repository >>>> >>>> Modified files: >>>> sys/kern kern_conf.c >>>> Log: >>>> Wait for thread count to reach zero in destroy_devl() even when no purge >>>> method is defined, to avoid memory being modified after free. >>>> >>>> Temporarily increase refcount in destroy_devl() to avoid a double free >>>> if dev_rel() is called while waiting for thread count to reach zero. >>>> >>>> Revision Changes Path >>>> 1.199 +6 -0 src/sys/kern/kern_conf.c -- Cheers, Tai-hwa Liang
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?0611142157336.5368>