svn commit: r272270 - head/sys/kern

[Garrett Cooper]

Hi Neel!
    Thank you for fixing this. I think we've run into similar issues with customizations to the tty code at Isilon. I have one comment...
Thanks!

> On Sep 28, 2014, at 14:12, Neel Natu <neel at FreeBSD.org> wrote:
> 
> Author: neel
> Date: Sun Sep 28 21:12:23 2014
> New Revision: 272270
> URL: http://svnweb.freebsd.org/changeset/base/272270
> 
> Log:
>  tty_rel_free() can be called more than once for the same tty so make sure
>  that the tty is dequeued from 'tty_list' only the first time.
> 
>  The panic below was seen when a revoke(2) was issued on an nmdm device.
>  In this case there was also a thread that was blocked on a read(2) on the
>  device. The revoke(2) woke up the blocked thread which would typically
>  return an error to userspace. In this case the reader also held the last
>  reference on the file descriptor so fdrop() ended up calling tty_rel_free()
>  via ttydev_close().
> 
>  tty_rel_free() then tried to dequeue 'tp' again which led to the panic.
> 
>  panic: Bad link elm 0xfffff80042602400 prev->next != elm
>  cpuid = 1
>  KDB: stack backtrace:
>  db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe00f9c90460
>  kdb_backtrace() at kdb_backtrace+0x39/frame 0xfffffe00f9c90510
>  vpanic() at vpanic+0x189/frame 0xfffffe00f9c90590
>  panic() at panic+0x43/frame 0xfffffe00f9c905f0
>  tty_rel_free() at tty_rel_free+0x29b/frame 0xfffffe00f9c90640
>  ttydev_close() at ttydev_close+0x1f9/frame 0xfffffe00f9c90690
>  devfs_close() at devfs_close+0x298/frame 0xfffffe00f9c90720
>  VOP_CLOSE_APV() at VOP_CLOSE_APV+0x13c/frame 0xfffffe00f9c90770
>  vn_close() at vn_close+0x194/frame 0xfffffe00f9c90810
>  vn_closefile() at vn_closefile+0x48/frame 0xfffffe00f9c90890
>  devfs_close_f() at devfs_close_f+0x2c/frame 0xfffffe00f9c908c0
>  _fdrop() at _fdrop+0x29/frame 0xfffffe00f9c908e0
>  sys_read() at sys_read+0x63/frame 0xfffffe00f9c90980
>  amd64_syscall() at amd64_syscall+0x2b3/frame 0xfffffe00f9c90ab0
>  Xfast_syscall() at Xfast_syscall+0xfb/frame 0xfffffe00f9c90ab0
>  --- syscall (3, FreeBSD ELF64, sys_read), rip = 0x800b78d8a, rsp = 0x7fffffbfdaf8, rbp = 0x7fffffbfdb30 ---
> 
>  CR:        https://reviews.freebsd.org/D851
>  Reviewed by:    glebius, ed
>  Reported by:    Leon Dang
>  Sponsored by:    Nahanni Systems
>  MFC after:    1 week
> 
> Modified:
>  head/sys/kern/tty.c
> 
> Modified: head/sys/kern/tty.c
> ==============================================================================
> --- head/sys/kern/tty.c    Sun Sep 28 20:06:02 2014    (r272269)
> +++ head/sys/kern/tty.c    Sun Sep 28 21:12:23 2014    (r272270)
> @@ -1055,13 +1055,13 @@ tty_rel_free(struct tty *tp)
>    tp->t_dev = NULL;
>    tty_unlock(tp);
> 
> -    sx_xlock(&tty_list_sx);
> -    TAILQ_REMOVE(&tty_list, tp, t_list);
> -    tty_list_count--;
> -    sx_xunlock(&tty_list_sx);
> -
> -    if (dev != NULL)
> +    if (dev != NULL) {

if (dev == NULL)
    return;

Would be result in less change in an MFC.

> +        sx_xlock(&tty_list_sx);
> +        TAILQ_REMOVE(&tty_list, tp, t_list);
> +        tty_list_count--;
> +        sx_xunlock(&tty_list_sx);
>        destroy_dev_sched_cb(dev, tty_dealloc, tp);
> +    }
> }
> 
> void