Messages in this thread | | | Date | Fri, 1 Jun 2012 21:56:20 +0100 | From | Alan Cox <> | Subject | Re: [PATCH] tty: add lockdep annotations |
| |
> Yes, tty->driver deref is ok (tty points to valid memory), but crash is > on tty->driver->ops (driver points to freed/illegal memory) > > using slub_debug=FZPU, I can indeed see RDI=6b6b6b6b6b6b6b6b
driver and driver->ops is basically const and it's not what you'd expect from a tty refcount bug. The driver side puts shouldn't have changed but I'll take a look over that patch and the error paths closely again just in case.
It could be that tty->driver is pointing at a valid but bogus location but again its not something I'd expect.
> By the way, release_one_tty() uses the following racy code : > > tty_driver_kref_put(driver); > module_put(driver->owner); > > I would use following patch to make sure bad things cant happen...
Agreed. Although we wouldn't be unloading console or pty so it's alas not the real cause.
Alan
| |