Panic in destroy_dev_sched_cb() for tty

[Jeremie Le Hen]

On Tue, Jul 06, 2010 at 12:54:36AM +0200, Ed Schouten wrote:
> * Jeremie Le Hen <jeremie at le-hen.org> wrote:
> > I've got a panic obviously from the tty layer but I couldn't get the
> > panic string as no remote system was connected using serial console, and
> > I don't know how to print it from DDB.
> 
> Hmmm... This is a tricky one, but I think I do understand what's going
> on here. If you close and revoke a TTY at the very exact moment, it may
> call destroy_dev_sched_cb() twice, where the second time it gets called
> on a null pointer.
> 
> ===================================================================
> --- sys/kern/tty.c	(revision 209570)
> +++ sys/kern/tty.c	(working copy)
> @@ -1040,7 +1040,8 @@
>  	tp->t_dev = NULL;
>  	tty_unlock(tp);
>  
> -	destroy_dev_sched_cb(dev, tty_dealloc, tp);
> +	if (dev != NULL)
> +		destroy_dev_sched_cb(dev, tty_dealloc, tp);
>  }
>  
>  void
> 
> I guess it's very hard to reproduce, right? If so, I'll just commit it
> to SVN. Thanks for reporting!

Sure it is.  I use screen heavily and this is the first time I get it.
Please go forward, I will update my kernel after it has been MFC and I
won't miss informing you if it occurs again.

Regards,
-- 
Jeremie Le Hen

Humans are born free and equal.  But some are more equal than others.
					    Coluche