[Bug 273418] [panic] Repeating kernel panic on open(/dev/console)

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=273418

Jason A. Harmening <jah@FreeBSD.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jah@FreeBSD.org

--- Comment #13 from Jason A. Harmening <jah@FreeBSD.org> ---
Per mjg's comment above, would something like this be useful as a starting
point for debugging? (WARNING: compile-tested only)

diff --git a/sys/fs/devfs/devfs_devs.c b/sys/fs/devfs/devfs_devs.c
index 6d8ce5cc3a63..245dcdc22307 100644
--- a/sys/fs/devfs/devfs_devs.c
+++ b/sys/fs/devfs/devfs_devs.c
@@ -175,6 +175,8 @@ devfs_free(struct cdev *cdev)
        struct cdev_priv *cdp;

        cdp = cdev2priv(cdev);
+       KASSERT((cdp->cdp_flags & CDP_ON_ACTIVE_LIST) == 0,
+           ("cdp %p still on active list", cdp));
        if (cdev->si_cred != NULL)
                crfree(cdev->si_cred);
        devfs_free_cdp_inode(cdp->cdp_inode);
@@ -521,6 +523,8 @@ devfs_populate_loop(struct devfs_mount *dm, int cleanup)
        dev_lock();
        TAILQ_FOREACH(cdp, &cdevp_list, cdp_list) {
                KASSERT(cdp->cdp_dirents != NULL, ("NULL cdp_dirents"));
+               KASSERT((cdp->cdp_flags & CDP_ON_ACTIVE_LIST) != 0,
+                   ("cdp %p should not be on active list", cdp));

                /*
                 * If we are unmounting, or the device has been destroyed,
@@ -552,6 +556,7 @@ devfs_populate_loop(struct devfs_mount *dm, int cleanup)
                if (!(cdp->cdp_flags & CDP_ACTIVE)) {
                        if (cdp->cdp_inuse > 0)
                                continue;
+                       cdp->cdp_flags &= ~CDP_ON_ACTIVE_LIST;
                        TAILQ_REMOVE(&cdevp_list, cdp, cdp_list);
                        dev_unlock();
                        dev_rel(&cdp->cdp_c);
@@ -703,7 +708,9 @@ devfs_create(struct cdev *dev)

        dev_lock_assert_locked();
        cdp = cdev2priv(dev);
-       cdp->cdp_flags |= CDP_ACTIVE;
+       KASSERT((cdp->cdp_flags & CDP_ON_ACTIVE_LIST) == 0,
+           ("cdp %p already on active list", cdp));
+       cdp->cdp_flags |= (CDP_ACTIVE | CDP_ON_ACTIVE_LIST);
        cdp->cdp_inode = alloc_unrl(devfs_inos);
        dev_refl(dev);
        TAILQ_INSERT_TAIL(&cdevp_list, cdp, cdp_list);
diff --git a/sys/fs/devfs/devfs_int.h b/sys/fs/devfs/devfs_int.h
index 26589e0bded6..9cf50c58018d 100644
--- a/sys/fs/devfs/devfs_int.h
+++ b/sys/fs/devfs/devfs_int.h
@@ -57,6 +57,7 @@ struct cdev_priv {
 #define CDP_ACTIVE             (1 << 0)
 #define CDP_SCHED_DTR          (1 << 1)
 #define        CDP_UNREF_DTR           (1 << 2)
+#define CDP_ON_ACTIVE_LIST     (1 << 3)

        u_int                   cdp_inuse;
        u_int                   cdp_maxdirent;
diff --git a/sys/fs/devfs/devfs_vnops.c b/sys/fs/devfs/devfs_vnops.c
index e8c8956d36fd..a8c3c2a36db5 100644
--- a/sys/fs/devfs/devfs_vnops.c
+++ b/sys/fs/devfs/devfs_vnops.c
@@ -1676,6 +1676,9 @@ devfs_revoke(struct vop_revoke_args *ap)
        dev_lock();
        cdp->cdp_inuse--;
        if (!(cdp->cdp_flags & CDP_ACTIVE) && cdp->cdp_inuse == 0) {
+               KASSERT((cdp->cdp_flags & CDP_ON_ACTIVE_LIST) != 0,
+                   ("cdp %p already not on active list", cdp));
+               cdp->cdp_flags &= ~CDP_ON_ACTIVE_LIST;
                TAILQ_REMOVE(&cdevp_list, cdp, cdp_list);
                dev_unlock();
                dev_rel(&cdp->cdp_c);

-- 
You are receiving this mail because:
You are the assignee for the bug.