Hi Alan ,

In our case we are seeing this, when tty_init_dev call is running on one core and flush_to_ldisc is
running on other core:

So in below case tty_port is intact , only tty  is reinitialized again.
   kworker

 -000|n_tty_receive_buf_common()
-001|n_tty_receive_buf2()
-002|tty_ldisc_receive_buf(inline)
-002|receive_buf(inline)
-002|flush_to_ldisc()
-003|__read_once_size(inline)
-003|static_key_count(inline)
-003|static_key_false(inline)
-003|trace_workqueue_execute_end(inline)
-003|process_one_work()
 init

-005|tty_unthrottle()
-006|n_tty_open()
-007|tty_ldisc_open.isra.3()
-008|tty_ldisc_setup()
-009|tty_init_dev()
-010|tty_open_by_driver(inline)
-010|tty_open()
-011|chrdev_open()
-012|do_dentry_open()
-013|vfs_open()
-014|do_last()
 



2. tty_init_dev when we set up a new tty

At that point the tty is not supposed to be receiving data and sure
enough we don't call tty->ops->open until it has finished the ldisc set
up, nor do we tty_init_dev a port that is already running.

So given we don't activate the port until tty->ops->open() calls
tty_port_open calls the port activation routine I don't see a bug.
So it seems this case only , open call has not completed but we have request for receive . 

What does a full (all CPU) trace of the bug look like and what tty driver
are you using when you capture the trace ?
We are using tty for console logging,
    |    tty = 0xFFFFFFFF477AC880 -> (
    |      magic = 21505,
    |      kref = (refcount = (counter = 2)),
    |      dev = 0xFFFFFFFFEDE3DA80,
    |      driver = 0xFFFFFFFFEDE2A480,
    |      ops = 0xFFFFFF9F26F7D0D0,
    |      index = 0,
    |      ldisc_sem = (count = 1, wait_lock = (raw_lock = (owner = 0, next = 0), magic = 3735899821, own
    |      termiox = 0x0,
    |      name = "ttyMSM0",
    |      pgrp = 0x0,

We have seen this issue on 4.9 and also one thing i have observed, before tty is getting reinit in tty_init_dev(),
there is console service exited before it in all the dumps.
 35206.969644:   <2> init: Service 'console' (pid 7440) exited with status 130
 35206.969690:   <2> init: Sending signal 9 to service 'console' (pid 7440) process group...
 35206.970857:   <2> init: kill(7440, 9) failed: No such process.

So how can we stop request of receive buff, if we already have tty_port and tty is getting reinitialized in midway like above
case?

Regards
Gaurav



-- 
Qualcomm India Private Limited, on behalf of Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum,
a Linux Foundation Collaborative Project.