From 1c375cd12687453983b431c85672403f5aa5b28c Mon Sep 17 00:00:00 2001
From: Matthew Dillon <dillon@apollo.backplane.com>
Date: Thu, 12 Aug 2010 22:45:25 -0700
Subject: [PATCH] kernel - Fix reboot races

* Fix a pty revoke race null pointer indirection during reboot

* Fix a deadlock with devfs (introduced by a recent commit) by
  not having devfs_config() do anything if it is called from
  the message core itself.
---
 sys/kern/tty_pty.c         | 25 +++++++++++++++----------
 sys/vfs/devfs/devfs_core.c | 13 +++++++------
 2 files changed, 22 insertions(+), 16 deletions(-)

diff --git a/sys/kern/tty_pty.c b/sys/kern/tty_pty.c
index 6bb06e35e7..9c1911bfc0 100644
--- a/sys/kern/tty_pty.c
+++ b/sys/kern/tty_pty.c
@@ -508,9 +508,11 @@ ptsstart(struct tty *tp)
 
 	if (tp->t_state & TS_TTSTOP)
 		return;
-	if (pti->pt_flags & PF_STOPPED) {
-		pti->pt_flags &= ~PF_STOPPED;
-		pti->pt_send = TIOCPKT_START;
+	if (pti) {
+		if (pti->pt_flags & PF_STOPPED) {
+			pti->pt_flags &= ~PF_STOPPED;
+			pti->pt_send = TIOCPKT_START;
+		}
 	}
 	ptcwakeup(tp, FREAD);
 }
@@ -705,13 +707,16 @@ ptsstop(struct tty *tp, int flush)
 	int flag;
 
 	/* note: FLUSHREAD and FLUSHWRITE already ok */
-	if (flush == 0) {
-		flush = TIOCPKT_STOP;
-		pti->pt_flags |= PF_STOPPED;
-	} else
-		pti->pt_flags &= ~PF_STOPPED;
-	pti->pt_send |= flush;
-	/* change of perspective */
+	if (pti) {
+		if (flush == 0) {
+			flush = TIOCPKT_STOP;
+			pti->pt_flags |= PF_STOPPED;
+		} else {
+			pti->pt_flags &= ~PF_STOPPED;
+		}
+		pti->pt_send |= flush;
+		/* change of perspective */
+	}
 	flag = 0;
 	if (flush & FREAD)
 		flag |= FWRITE;
diff --git a/sys/vfs/devfs/devfs_core.c b/sys/vfs/devfs/devfs_core.c
index e773570862..0e13267c3c 100644
--- a/sys/vfs/devfs/devfs_core.c
+++ b/sys/vfs/devfs/devfs_core.c
@@ -2301,14 +2301,14 @@ devfs_release_ops(struct dev_ops *ops)
 /*
  * Wait for asynchronous messages to complete in the devfs helper
  * thread, then return.  Do nothing if the helper thread is dead
- * (during reboot).
+ * or we are being indirectly called from the helper thread itself.
  */
 void
 devfs_config(void)
 {
 	devfs_msg_t msg;
 
-	if (devfs_run) {
+	if (devfs_run && curthread != td_core) {
 		msg = devfs_msg_get();
 		msg = devfs_msg_send_sync(DEVFS_SYNC, msg);
 		devfs_msg_put(msg);
@@ -2355,7 +2355,8 @@ devfs_init(void)
 	lwkt_create(devfs_msg_core, /*args*/NULL, &td_core, NULL,
 		    0, 0, "devfs_msg_core");
 
-	tsleep(td_core/*devfs_id*/, 0, "devfsc", 0);
+	while (devfs_run == 0)
+		tsleep(td_core, 0, "devfsc", 0);
 
 	devfs_debug(DEVFS_DEBUG_DEBUG, "devfs_init finished\n");
 }
@@ -2370,9 +2371,9 @@ devfs_uninit(void)
 	devfs_debug(DEVFS_DEBUG_DEBUG, "devfs_uninit() called\n");
 
 	devfs_msg_send(DEVFS_TERMINATE_CORE, NULL);
-
-	tsleep(td_core/*devfs_id*/, 0, "devfsc", 0);
-	tsleep(td_core/*devfs_id*/, 0, "devfsc", 10000);
+	while (devfs_run)
+		tsleep(td_core, 0, "devfsc", hz*10);
+	tsleep(td_core, 0, "devfsc", hz);
 
 	devfs_clone_bitmap_uninit(&DEVFS_CLONE_BITMAP(ops_id));
 
-- 
2.41.0