Re: WARNING at: drivers/char/tty_ldisc.c

[Sergey Senozhatsky]

On (08/02/09 10:16), Linus Torvalds wrote:
> > Looks like we have one more bug in tty code:
> > 'shutdown -r now' in 'single' user mode gives following trace:
> > 
> > WARNING at: drivers/char/tty_ldisc.c:209 tty_ldisc_put+0x95/0xa0
> > ---
> > warn_slowpath_common+0x78/0xa0
> > warn_slowpath_null+0x21/0x40
> > tty_ldisc_put+0x95/0xa0
> > tty_ldisc_hangup+0xfc/0x1f0
> > do_tty_hangup+0x131/0x380
> > disassociate_ctty+0x50/0x210
> > do_exit+0x6b8/0x700
> > do_group_exit+0x45/0xb0
> > get_signal_to_deliver+0x226/0x410
> > do_notify_resume+0xc1+0xa90
> > work_notifysig+0x13/0x19
> > 
> > //There is no trace in syslog, so given one is 'copy-paste' from the paper.
> 
> We have that 'refcount' counter for the ldisc, but we don't actually use 
> it for memory management like we should (ie "free the ldisc when count 
> goes to zero"), we just decrement it and free the thing.
> 
> And it's quite possible that another CPU is doing some tty read thing or 
> other that does
> 
> 	tty_ldisc_try(..) // increments ld->refcount
> 	...
> 	tty_ldisc_deref(..) // decrements it.
> 
> at the same time. 
>

non-SMP system 'fails' as well.

 
> The ldisc refcounts are simply done wrong. They are more debugging aids 
> (for the case where no races occur), than actual memory management 
> refcounts.
> 
tty_ldisc.c:798  tty_ldisc_hangup
	WARN_ON(tty_ldisc_wait_idle(tty) != 0);

gave WARN_ON traces.

So, it seems refcount is wrong before
	tty_ldisc_halt(tty);
	tty_ldisc_wait_idle(tty);

	/* which is */
	if (wait_event_timeout(tty_ldisc_wait, 
		tty->ldisc->refcount == 0, 5 * HZ) == 0)
		return -EBUSY;

	Sergey

Attachment: signature.asc
Description: Digital signature