svn commit: r294598 - head/sys/kern

[Konstantin Belousov]

Author: kib
Date: Fri Jan 22 20:38:46 2016
New Revision: 294598
URL: https://svnweb.freebsd.org/changeset/base/294598

Log:
  In tty_dealloc(), clear the queues.  See the comment for a scenario
  which explains why ttydev_leave() cleanup might not happen.
  
  Submitted by:	bde
  MFC after:	3 weeks

Modified:
  head/sys/kern/tty.c

Modified: head/sys/kern/tty.c
==============================================================================
--- head/sys/kern/tty.c	Fri Jan 22 20:36:03 2016	(r294597)
+++ head/sys/kern/tty.c	Fri Jan 22 20:38:46 2016	(r294598)
@@ -213,7 +213,7 @@ ttydev_leave(struct tty *tp)
 
 	ttydisc_close(tp);
 
-	/* Destroy associated buffers already. */
+	/* Free i/o queues now since they might be large. */
 	ttyinq_free(&tp->t_inq);
 	tp->t_inlow = 0;
 	ttyoutq_free(&tp->t_outq);
@@ -1031,10 +1031,15 @@ tty_dealloc(void *arg)
 {
 	struct tty *tp = arg;
 
-	/* Make sure we haven't leaked buffers. */
-	MPASS(ttyinq_getsize(&tp->t_inq) == 0);
-	MPASS(ttyoutq_getsize(&tp->t_outq) == 0);
-
+	/*
+	 * ttyydev_leave() usually frees the i/o queues earlier, but it is
+	 * not always called between queue allocation and here.  The queues
+	 * may be allocated by ioctls on a pty control device without the
+	 * corresponding pty slave device ever being open, or after it is
+	 * closed.
+	 */
+	ttyinq_free(&tp->t_inq);
+	ttyoutq_free(&tp->t_outq);
 	seldrain(&tp->t_inpoll);
 	seldrain(&tp->t_outpoll);
 	knlist_destroy(&tp->t_inpoll.si_note);