2.6.21-rc4-mm1: init hangs on tty_mutex

2.6.21-rc4-mm1: init hangs on tty_mutex

[Hugh Dickins]

I get a hang at startup or shutdown: tiocsctty() holds tty_mutex, and
now with Eric's tty-in-tiocsctty-when-we-steal-a-tty-hang-it-up.patch
it can end up calling con_close(), which tries to take tty_mutex.
So best revert that in hot-fixes, until Eric provides a better.

Signed-off-by: Hugh Dickins <hugh@veritas.com>

--- 2.6.21-rc4-mm1/drivers/char/tty_io.c	2007-03-20 12:49:34.000000000 +0000
+++ linux/drivers/char/tty_io.c	2007-03-20 18:14:53.000000000 +0000
@@ -2980,7 +2980,9 @@ static int tiocsctty(struct tty_struct *
 			/*
 			 * Steal it away
 			 */
-			tty_vhangup(tty);
+			read_lock(&tasklist_lock);
+			session_clear_tty(tty->session);
+			read_unlock(&tasklist_lock);
 		} else {
 			ret = -EPERM;
 			goto unlock;

Re: 2.6.21-rc4-mm1: init hangs on tty_mutex

[Eric W. Biederman]

Hugh Dickins <hugh@veritas.com> writes:

> I get a hang at startup or shutdown: tiocsctty() holds tty_mutex, and
> now with Eric's tty-in-tiocsctty-when-we-steal-a-tty-hang-it-up.patch
> it can end up calling con_close(), which tries to take tty_mutex.
> So best revert that in hot-fixes, until Eric provides a better.

Well I'm confused I know I tested this, and I even added a printk and
saw it trigger a couple of times.

Hmm.  Looking at the code it is clearly not safe to hold the tty_mutex
when calling tty_vhangup.  I thought the other caller in tty_io.c was doing
that but on a second glance it is clearly not.  And the hangup and close
methods do seem to take the tty_mutex.

How this worked in my testing is beyond me..

I will see if I can generate a better patch later.

Acked-by: Eric W. Biederman <ebiederm@xmission.com>

>
> Signed-off-by: Hugh Dickins <hugh@veritas.com>
>
> --- 2.6.21-rc4-mm1/drivers/char/tty_io.c 2007-03-20 12:49:34.000000000 +0000
> +++ linux/drivers/char/tty_io.c	2007-03-20 18:14:53.000000000 +0000
> @@ -2980,7 +2980,9 @@ static int tiocsctty(struct tty_struct *
>  			/*
>  			 * Steal it away
>  			 */
> -			tty_vhangup(tty);
> +			read_lock(&tasklist_lock);
> +			session_clear_tty(tty->session);
> +			read_unlock(&tasklist_lock);
>  		} else {
>  			ret = -EPERM;
>  			goto unlock;

Re: 2.6.21-rc4-mm1: init hangs on tty_mutex

[Hugh Dickins]

On Tue, 20 Mar 2007, Eric W. Biederman wrote:
> Hugh Dickins <hugh@veritas.com> writes:
> 
> > I get a hang at startup or shutdown: tiocsctty() holds tty_mutex, and
> > now with Eric's tty-in-tiocsctty-when-we-steal-a-tty-hang-it-up.patch
> > it can end up calling con_close(), which tries to take tty_mutex.
> > So best revert that in hot-fixes, until Eric provides a better.
> 
> Well I'm confused I know I tested this, and I even added a printk and
> saw it trigger a couple of times.
> 
> Hmm.  Looking at the code it is clearly not safe to hold the tty_mutex
> when calling tty_vhangup.  I thought the other caller in tty_io.c was doing
> that but on a second glance it is clearly not.  And the hangup and close
> methods do seem to take the tty_mutex.
> 
> How this worked in my testing is beyond me..

I agree there's something weird about it, and wonder whether it's
exposing some other, unrelated bug e.g. something uninitialized.

What I omitted to mention is that I reliably had init hanging on
startup with my KDB kernels (on i386 UP and i386 SMP and x86_64 SMP);
but never saw my non-KDB kernels (nor my powerpc kernel) hanging
there at startup - they would hang (in the same way) at shutdown
(every time? I can't swear to that).  But I can't imagine what
KDB would have to do with it, other than shifting stuff around.

Hugh