Messages in this thread Patch in this message | | | Subject | Re: [PATCH] tty: add lockdep annotations | From | Eric Dumazet <> | Date | Sat, 02 Jun 2012 14:30:31 +0200 |
| |
On Sat, 2012-06-02 at 12:57 +0100, Alan Cox wrote:
> I'll have a look at this ASAP - I think the driver ref counting side is a > red herring but I'll build an Ubuntu 12 setup and try and replicate the > crash once I'm back at work (its a national holiday here Sat-Tue for the > English queens jubilee)
With following debugging patch I now have crashes at every boot, so it might be more easy to find the bug :
stack trace : tty_lock (BUG_ON in kref_get()) tty_open chrdev_open do_dentry_open nameidata_to_filp
diff --git a/include/linux/kref.h b/include/linux/kref.h index 9c07dce..49a9acf 100644 --- a/include/linux/kref.h +++ b/include/linux/kref.h @@ -18,6 +18,7 @@ #include <linux/bug.h> #include <linux/atomic.h> #include <linux/kernel.h> +#include <linux/poison.h> struct kref { atomic_t refcount; @@ -39,6 +40,7 @@ static inline void kref_init(struct kref *kref) static inline void kref_get(struct kref *kref) { WARN_ON(!atomic_read(&kref->refcount)); + BUG_ON(atomic_read(&kref->refcount) == POISON_FREE_INT); atomic_inc(&kref->refcount); } @@ -65,7 +67,9 @@ static inline int kref_sub(struct kref *kref, unsigned int count, { WARN_ON(release == NULL); + BUG_ON(atomic_read(&kref->refcount) == POISON_FREE_INT); if (atomic_sub_and_test((int) count, &kref->refcount)) { + atomic_set(&kref->refcount, POISON_FREE_INT); release(kref); return 1; } diff --git a/include/linux/poison.h b/include/linux/poison.h index 2110a81..2947582 100644 --- a/include/linux/poison.h +++ b/include/linux/poison.h @@ -48,6 +48,9 @@ #define POISON_FREE 0x6b /* for use-after-free poisoning */ #define POISON_END 0xa5 /* end-byte of poisoning */ +#define POISON_FREE_SHORT ((POISON_FREE << 8) + POISON_FREE) +#define POISON_FREE_INT ((POISON_FREE_SHORT << 16) + POISON_FREE_SHORT) + /********** arch/$ARCH/mm/init.c **********/ #define POISON_FREE_INITMEM 0xcc
| |