Panic in destroy_dev_sched_cb() for tty

[Ed Schouten]

* Jeremie Le Hen <jeremie at le-hen.org> wrote:
> I've got a panic obviously from the tty layer but I couldn't get the
> panic string as no remote system was connected using serial console, and
> I don't know how to print it from DDB.

Hmmm... This is a tricky one, but I think I do understand what's going
on here. If you close and revoke a TTY at the very exact moment, it may
call destroy_dev_sched_cb() twice, where the second time it gets called
on a null pointer.

===================================================================
--- sys/kern/tty.c	(revision 209570)
+++ sys/kern/tty.c	(working copy)
@@ -1040,7 +1040,8 @@
 	tp->t_dev = NULL;
 	tty_unlock(tp);
 
-	destroy_dev_sched_cb(dev, tty_dealloc, tp);
+	if (dev != NULL)
+		destroy_dev_sched_cb(dev, tty_dealloc, tp);
 }
 
 void

I guess it's very hard to reproduce, right? If so, I'll just commit it
to SVN. Thanks for reporting!

-- 
 Ed Schouten <ed at 80386.nl>
 WWW: http://80386.nl/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 196 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-stable/attachments/20100705/d3f79626/attachment.pgp