Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757655AbcDHGeb (ORCPT ); Fri, 8 Apr 2016 02:34:31 -0400 Received: from szxga03-in.huawei.com ([119.145.14.66]:17941 "EHLO szxga03-in.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752616AbcDHGea (ORCPT ); Fri, 8 Apr 2016 02:34:30 -0400 From: Yang Yingliang To: CC: Yang Yingliang , Greg Kroah-Hartman , Jiri Slaby Subject: [PATCH] drivers/tty: fix BUG_ON when calls serial8250_suspend_port Date: Fri, 8 Apr 2016 14:33:55 +0800 Message-ID: <1460097235-7356-1-git-send-email-yangyingliang@huawei.com> X-Mailer: git-send-email 1.9.5.msysgit.1 MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [10.177.19.219] X-CFilter-Loop: Reflected X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), refid=str=0001.0A0B0203.570750F0.018D,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0, ip=0.0.0.0, so=2013-05-26 15:14:31, dmn=2013-03-21 17:37:32 X-Mirapoint-Loop-Id: 7421ef76a63cd0ef34acb61c754ce4b0 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 3272 Lines: 88 My kthread calls serial8250_suspend_port/serial8250_resume_port when the system is booting, it triggers a BUG_ON: BUG: failure at drivers/tty/serial/8250/8250_core.c:1852/serial_unlink_irq_chain()! Kernel panic - not syncing: BUG! CPU: 21 PID: 927 Comm: uart_debug_thre Not tainted 4.1.18+ #96 Call trace: [] dump_backtrace+0x0/0x128 [] show_stack+0x14/0x1c [] dump_stack+0x88/0xa8 [] panic+0xe4/0x228 [] univ8250_release_irq+0xc0/0x124 [] serial8250_do_shutdown+0xdc/0x144 [] serial8250_shutdown+0x20/0x28 [] uart_suspend_port+0x200/0x234 [] serial8250_suspend_port+0x5c/0xac [] uart_debug+0x24/0x3c [] kthread+0xdc/0xf0 I found port->flags is used without lock in tty_port_block_til_ready(). The flags will be overwritten with old value after it updates in uart_suspend_port(). CPU A CPU B in uart_suspend_port in tty_port_block_til_ready get port->flags clear ASYNCB_INITIALIZED set port->flags The flags still has ASYNCB_INITIALIZED. When uart_suspend_port is called next time, it trriggers the BUG_ON. So use set_bit/clear_bit to avoid the flags being overwritten. Cc: Greg Kroah-Hartman Cc: Jiri Slaby Signed-off-by: Yang Yingliang --- drivers/tty/tty_port.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/drivers/tty/tty_port.c b/drivers/tty/tty_port.c index 40b3183..d57cf70 100644 --- a/drivers/tty/tty_port.c +++ b/drivers/tty/tty_port.c @@ -237,7 +237,7 @@ void tty_port_hangup(struct tty_port *port) spin_lock_irqsave(&port->lock, flags); port->count = 0; - port->flags &= ~ASYNC_NORMAL_ACTIVE; + clear_bit(ASYNCB_NORMAL_ACTIVE, &port->flags); tty = port->tty; if (tty) set_bit(TTY_IO_ERROR, &tty->flags); @@ -376,14 +376,14 @@ int tty_port_block_til_ready(struct tty_port *port, /* if non-blocking mode is set we can pass directly to open unless the port has just hung up or is in another error state */ if (tty->flags & (1 << TTY_IO_ERROR)) { - port->flags |= ASYNC_NORMAL_ACTIVE; + set_bit(ASYNCB_NORMAL_ACTIVE, &port->flags); return 0; } if (filp->f_flags & O_NONBLOCK) { /* Indicate we are open */ if (tty->termios.c_cflag & CBAUD) tty_port_raise_dtr_rts(port); - port->flags |= ASYNC_NORMAL_ACTIVE; + set_bit(ASYNCB_NORMAL_ACTIVE, &port->flags); return 0; } @@ -443,7 +443,7 @@ int tty_port_block_til_ready(struct tty_port *port, port->count++; port->blocked_open--; if (retval == 0) - port->flags |= ASYNC_NORMAL_ACTIVE; + set_bit(ASYNCB_NORMAL_ACTIVE, &port->flags); spin_unlock_irqrestore(&port->lock, flags); return retval; } @@ -533,7 +533,8 @@ void tty_port_close_end(struct tty_port *port, struct tty_struct *tty) spin_lock_irqsave(&port->lock, flags); wake_up_interruptible(&port->open_wait); } - port->flags &= ~(ASYNC_NORMAL_ACTIVE | ASYNC_CLOSING); + clear_bit(ASYNCB_NORMAL_ACTIVE, &port->flags); + clear_bit(ASYNCB_CLOSING, &port->flags); wake_up_interruptible(&port->close_wait); spin_unlock_irqrestore(&port->lock, flags); } -- 2.5.0