From: Alan Cox <alan@lxorguk.ukuu.org.uk>
To: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>,
Alan Cox <alan@linux.intel.com>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
Jens Axboe <jaxboe@fusionio.com>
Subject: Re: [PATCH] tty: add lockdep annotations
Date: Fri, 1 Jun 2012 21:56:20 +0100 [thread overview]
Message-ID: <20120601215620.305155c0@pyramind.ukuu.org.uk> (raw)
In-Reply-To: <1338583498.2760.1648.camel@edumazet-glaptop>
> Yes, tty->driver deref is ok (tty points to valid memory), but crash is
> on tty->driver->ops (driver points to freed/illegal memory)
>
> using slub_debug=FZPU, I can indeed see RDI=6b6b6b6b6b6b6b6b
driver and driver->ops is basically const and it's not what you'd expect
from a tty refcount bug. The driver side puts shouldn't have changed but
I'll take a look over that patch and the error paths closely again just
in case.
It could be that tty->driver is pointing at a valid but bogus location
but again its not something I'd expect.
> By the way, release_one_tty() uses the following racy code :
>
> tty_driver_kref_put(driver);
> module_put(driver->owner);
>
> I would use following patch to make sure bad things cant happen...
Agreed. Although we wouldn't be unloading console or pty so it's alas not
the real cause.
Alan
next prev parent reply other threads:[~2012-06-01 20:53 UTC|newest]
Thread overview: 39+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-05-30 12:54 [GIT PULL] Block driver bits for 3.5 Jens Axboe
2012-05-30 18:33 ` Eric Dumazet
2012-05-30 18:55 ` Jens Axboe
2012-05-30 19:08 ` Eric Dumazet
2012-05-30 19:17 ` Jens Axboe
2012-05-30 20:35 ` Eric Dumazet
2012-05-30 20:58 ` Linus Torvalds
2012-05-31 9:35 ` [PATCH] tty: add lockdep annotations Eric Dumazet
2012-05-31 11:45 ` Jiri Kosina
2012-05-31 11:59 ` Eric Dumazet
2012-06-01 18:17 ` Eric Dumazet
2012-06-01 18:51 ` Linus Torvalds
2012-06-01 20:38 ` Alan Cox
2012-06-01 20:46 ` Eric Dumazet
2012-06-01 20:44 ` Eric Dumazet
2012-06-01 20:56 ` Alan Cox [this message]
2012-06-01 20:59 ` Eric Dumazet
2012-06-02 7:17 ` Eric Dumazet
2012-06-02 7:55 ` Eric Dumazet
2012-06-02 8:01 ` Eric Dumazet
2012-06-02 11:57 ` Alan Cox
2012-06-02 12:30 ` Eric Dumazet
2012-06-02 18:38 ` Linus Torvalds
2012-06-02 19:59 ` Linus Torvalds
2012-06-02 20:01 ` Linus Torvalds
2012-06-02 20:19 ` Alan Cox
2012-06-02 22:25 ` Linus Torvalds
2012-06-02 23:02 ` Alan Cox
2012-06-02 23:14 ` Linus Torvalds
2012-06-03 1:37 ` Linus Torvalds
2012-06-03 13:06 ` Alan Cox
2012-06-03 13:24 ` Alan Cox
2012-06-03 19:44 ` Eric Dumazet
2012-06-02 20:00 ` Alan Cox
2012-05-31 10:38 ` [PATCH] block: avoid infinite loop in get_task_io_context() Eric Dumazet
2012-05-31 10:47 ` Jens Axboe
2012-05-31 10:51 ` Eric Dumazet
2012-05-31 10:56 ` Jens Axboe
2012-06-01 5:06 ` Tejun Heo
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20120601215620.305155c0@pyramind.ukuu.org.uk \
--to=alan@lxorguk.ukuu.org.uk \
--cc=alan@linux.intel.com \
--cc=eric.dumazet@gmail.com \
--cc=jaxboe@fusionio.com \
--cc=linux-kernel@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®