Messages in this thread | | | Date | Wed, 6 Jun 2012 00:27:25 +0100 | From | Alan Cox <> | Subject | Re: BUG: tty_insert_flip_string_fixed_flag, unable to handle kernel NULL pointer dereference at 00000004 |
| |
> [ 5350.556089] [<c027adc4>] pty_write+0x2c/0x4c > [ 5350.556089] [<c0277a44>] n_tty_write+0x24e/0x2d6 > [ 5350.556089] [<c0144a2b>] ? try_to_wake_up+0x18c/0x18c
Basically the other end hung up just as it went to write.
It's a known race. In the current codebase it's very hard to fix up nicely as we have to drop tty_lock during a pty close or we deadlock. It's very hard to hit but your environment sounds rather like my test case for it !
It's one of a series of related bugs (another in n_gsm) that we can't fix elegantly until the tty locking is fixed - which has been pushed from 3.5 hopefully to 3.6 assuming we can fix a couple of other locking problems first.
What may reduce it a lot is to change pty_write to do
struct tty_struct *to = tty->link;
if (tty->stopped) return 0;
if (to == NULL) return -ENODEV; to = tty_kref_get(to); if (tty->link == NULL) { tty_kref_put(to); return -ENODEV; } if (c > 0) { ... } tty_kref_put(to); return c; }
Thats a pretty ugly bandaid but I'd be interested to know if it helps, as that would verify the race you are hitting is the one I think it is.
Alan
| |