Hi Alan ,

In our case we are seeing this, when tty_init_dev call is running on one 
core and flush_to_ldisc is
running on other core:

So in below case tty_port is intact , only tty  is reinitialized again.
    kworker

  -000|n_tty_receive_buf_common()
-001|n_tty_receive_buf2()
-002|tty_ldisc_receive_buf(inline)
-002|receive_buf(inline)
-002|flush_to_ldisc()
-003|__read_once_size(inline)
-003|static_key_count(inline)
-003|static_key_false(inline)
-003|trace_workqueue_execute_end(inline)
-003|process_one_work()
	init

-005|tty_unthrottle()
-006|n_tty_open()
-007|tty_ldisc_open.isra.3()
-008|tty_ldisc_setup()
-009|tty_init_dev()
-010|tty_open_by_driver(inline)
-010|tty_open()
-011|chrdev_open()
-012|do_dentry_open()
-013|vfs_open()
-014|do_last()


>
>
> 2. tty_init_dev when we set up a new tty
>
> At that point the tty is not supposed to be receiving data and sure
> enough we don't call tty->ops->open until it has finished the ldisc set
> up, nor do we tty_init_dev a port that is already running.
>
> So given we don't activate the port until tty->ops->open() calls
> tty_port_open calls the port activation routine I don't see a bug.
So it seems this case only , open call has not completed but we have 
request for receive .
>
> What does a full (all CPU) trace of the bug look like and what tty driver
> are you using when you capture the trace ?
We are using tty for console logging,
     |    tty = 0xFFFFFFFF477AC880 -> (
     |      magic = 21505,
     |      kref = (refcount = (counter = 2)),
     |      dev = 0xFFFFFFFFEDE3DA80,
     |      driver = 0xFFFFFFFFEDE2A480,
     |      ops = 0xFFFFFF9F26F7D0D0,
     |      index = 0,
     |      ldisc_sem = (count = 1, wait_lock = (raw_lock = (owner = 0, 
next = 0), magic = 3735899821, own
     |      termiox = 0x0,
     |      name = "ttyMSM0",
     |      pgrp = 0x0,

We have seen this issue on 4.9 and also one thing i have observed, 
before tty is getting reinit in tty_init_dev(),
there is console service exited before it in all the dumps.
  35206.969644:   <2> init: Service 'console' (pid 7440) exited with 
status 130
  35206.969690:   <2> init: Sending signal 9 to service 'console' (pid 
7440) process group...
  35206.970857:   <2> init: kill(7440, 9) failed: No such process.

So how can we stop request of receive buff, if we already have tty_port 
and tty is getting reinitialized in midway like above
case?

Regards
Gaurav



-- 
Qualcomm India Private Limited, on behalf of Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum,
a Linux Foundation Collaborative Project.