Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754505Ab0KYRQg (ORCPT ); Thu, 25 Nov 2010 12:16:36 -0500 Received: from mail.pripojeni.net ([217.66.174.14]:49765 "EHLO smtp.pripojeni.net" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1754162Ab0KYRQf (ORCPT ); Thu, 25 Nov 2010 12:16:35 -0500 From: Jiri Slaby To: gregkh@suse.de Cc: akpm@linux-foundation.org, linux-kernel@vger.kernel.org, jirislaby@gmail.com, Kyle McMartin , Alan Cox Subject: [PATCH 1/1] TTY: don't allow reopen when ldisc is changing Date: Thu, 25 Nov 2010 18:16:23 +0100 Message-Id: <1290705383-6608-1-git-send-email-jslaby@suse.cz> X-Mailer: git-send-email 1.7.3.1 In-Reply-To: <4CEE93FF.3040507@suse.cz> References: <4CEE93FF.3040507@suse.cz> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2640 Lines: 83 There are many WARNINGs like the following reported nowadays: WARNING: at drivers/tty/tty_io.c:1331 tty_open+0x2a2/0x49a() Hardware name: Latitude E6500 Modules linked in: Pid: 1207, comm: plymouthd Not tainted 2.6.37-rc3-mmotm1123 #3 Call Trace: [] warn_slowpath_common+0x80/0x98 [] warn_slowpath_null+0x15/0x17 [] tty_open+0x2a2/0x49a [] chrdev_open+0x11d/0x146 ... This means tty_reopen is called without TTY_LDISC set. For further considerations, note tty_lock is held in tty_open. TTY_LDISC is cleared in: 1) __tty_hangup from tty_ldisc_hangup to tty_ldisc_enable. During this section tty_lock is held. 2) tty_release via tty_ldisc_release till the end of tty existence. If tty->count <= 1, tty_lock is taken, TTY_CLOSING bit set and then tty_ldisc_release called. tty_reopen checks TTY_CLOSING before checking TTY_LDISC. 3) tty_set_ldisc from tty_ldisc_halt to tty_ldisc_enable. We: * take tty_lock, set TTY_LDISC_CHANGING, put tty_lock * call tty_ldisc_halt (clear TTY_LDISC), tty_lock is _not_ held * do some other work * take tty_lock, call tty_ldisc_enable (set TTY_LDISC), put tty_lock So the only option I see is 3). The solution is to check TTY_LDISC_CHANGING along with TTY_CLOSING in tty_reopen. Nicely reproducible with two processes: while (1) { fd = open("/dev/ttyS1", O_RDWR); if (fd < 0) { warn("open"); continue; } close(fd); } -------- while (1) { fd = open("/dev/ttyS1", O_RDWR); ld1 = 0; ld2 = 2; while (1) { ioctl(fd, TIOCSETD, &ld1); ioctl(fd, TIOCSETD, &ld2); } close(fd); } Signed-off-by: Jiri Slaby Reported-by: Cc: Kyle McMartin Cc: Alan Cox --- drivers/tty/tty_io.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c index c05c5af..878f6d6 100644 --- a/drivers/tty/tty_io.c +++ b/drivers/tty/tty_io.c @@ -1310,7 +1310,8 @@ static int tty_reopen(struct tty_struct *tty) { struct tty_driver *driver = tty->driver; - if (test_bit(TTY_CLOSING, &tty->flags)) + if (test_bit(TTY_CLOSING, &tty->flags) || + test_bit(TTY_LDISC_CHANGING, &tty->flags)) return -EIO; if (driver->type == TTY_DRIVER_TYPE_PTY && -- 1.7.3.1 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/