From dds@istlab.dmst.aueb.gr  Thu Nov 11 15:19:23 2004
Return-Path: <dds@istlab.dmst.aueb.gr>
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 6ACCD16A4D1
	for <FreeBSD-gnats-submit@freebsd.org>; Thu, 11 Nov 2004 15:19:23 +0000 (GMT)
Received: from istlab.dmst.aueb.gr (istlab.dmst.aueb.gr [195.251.249.147])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 97EBC43D62
	for <FreeBSD-gnats-submit@freebsd.org>; Thu, 11 Nov 2004 15:19:22 +0000 (GMT)
	(envelope-from dds@istlab.dmst.aueb.gr)
Received: from istlab.dmst.aueb.gr (localhost [127.0.0.1])
	by istlab.dmst.aueb.gr (8.13.1/8.13.1) with ESMTP id iABFJKPh082968
	for <FreeBSD-gnats-submit@freebsd.org>; Thu, 11 Nov 2004 17:19:20 +0200 (EET)
	(envelope-from dds@istlab.dmst.aueb.gr)
Received: (from dds@localhost)
	by istlab.dmst.aueb.gr (8.13.1/8.13.1/Submit) id iABFJKkK082967;
	Thu, 11 Nov 2004 17:19:20 +0200 (EET)
	(envelope-from dds)
Message-Id: <200411111519.iABFJKkK082967@istlab.dmst.aueb.gr>
Date: Thu, 11 Nov 2004 17:19:20 +0200 (EET)
From: Diomidis Spinellis <dds@aueb.gr>
Reply-To: Diomidis Spinellis <dds@aueb.gr>
To: FreeBSD-gnats-submit@freebsd.org
Cc:
Subject: poll(2) returns POLLIN / POLLOUT on TS_ZOMBIE ttys
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         73821
>Category:       kern
>Synopsis:       poll(2) returns POLLIN / POLLOUT on TS_ZOMBIE ttys
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    dds
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Thu Nov 11 15:20:18 GMT 2004
>Closed-Date:    Fri Apr 08 21:46:16 GMT 2005
>Last-Modified:  Fri Apr 08 21:46:16 GMT 2005
>Originator:     Diomidis Spinellis
>Release:        FreeBSD 4.10-STABLE i386
>Organization:
AUEB
>Environment:
System: FreeBSD istlab.dmst.aueb.gr 4.10-STABLE FreeBSD 4.10-STABLE #23: Fri Oct 8 15:53:45 EEST 2004 dds@istlab.dmst.aueb.gr:/usr/obj/usr/src/sys/ISTLAB i386

>Description:
When a tty line toggles its DCD it enters the TS_ZOMBIE state.  In
that state input and output are not possible.  Yet poll(2) will
return POLLIN / POLLOUT in that state - even if no I/O is possible.

Example:

$ pstat -t
  LINE RAW CAN OUT IHIWT ILOWT OHWT LWT     COL STATE  SESS      PGID DISC
  cuaa0 22   0   0 11520 10080 4104 256    7274 OlZ           0     0 term

$ strace -p 8539
poll([{fd=4, events=POLLIN|POLLRDNORM|POLLERR, revents=POLLIN|POLLRDNORM}], 1, 0) = 1
read(4, "", 1024)                       = 0

In the above example /dev/cuaa0 is in the TS_ZOMBIE state (Z).  Poll(2) returns
POLLIN, yet read(2) returns 0.

>How-To-Repeat:
Probably by toggling the DCD line of a device read by a program using
poll(2).
>Fix:
Modify tty's poll(2) interface to return POLLERR for TS_ZOMBIE ttys.
POLLERR is defined as:
    An error has occurred on the device or stream.

Can not return POLLHUP because according to POSIX 1003.1 (2004):
POLLHUP
    The device has been disconnected. This event and POLLOUT are mutually-exclusive; a stream can never be writable if a hangup has occurred.


The following patch implements the proposed change:
Index: tty.c
===================================================================
RCS file: /home/ncvs/src/sys/kern/tty.c,v
retrieving revision 1.240
diff -u -r1.240 tty.c
--- tty.c	3 Nov 2004 19:16:55 -0000	1.240
+++ tty.c	11 Nov 2004 14:55:25 -0000
@@ -1283,19 +1283,20 @@
 
 	s = spltty();
 	if (events & (POLLIN | POLLRDNORM)) {
-		if (ttnread(tp) > 0 || ISSET(tp->t_state, TS_ZOMBIE))
+		if (ttnread(tp) > 0)
 			revents |= events & (POLLIN | POLLRDNORM);
 		else
 			selrecord(td, &tp->t_rsel);
 	}
 	if (events & (POLLOUT | POLLWRNORM)) {
-		if ((tp->t_outq.c_cc <= tp->t_olowat &&
-		     ISSET(tp->t_state, TS_CONNECTED))
-		    || ISSET(tp->t_state, TS_ZOMBIE))
+		if (tp->t_outq.c_cc <= tp->t_olowat &&
+		    ISSET(tp->t_state, TS_CONNECTED))
 			revents |= events & (POLLOUT | POLLWRNORM);
 		else
 			selrecord(td, &tp->t_wsel);
 	}
+	if (ISSET(tp->t_state, TS_ZOMBIE))
+		revents |= POLLERR;
 	splx(s);
 	return (revents);
 }
>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->dds 
Responsible-Changed-By: dds 
Responsible-Changed-When: Thu Nov 11 15:23:07 GMT 2004 
Responsible-Changed-Why:  
Same person, different hat. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=73821 
State-Changed-From-To: open->patched 
State-Changed-By: dds 
State-Changed-When: Thu Nov 11 16:17:11 GMT 2004 
State-Changed-Why:  
sys/kern/tty.c 1.241 

http://www.freebsd.org/cgi/query-pr.cgi?pr=73821 

From: Matteo Riondato <rionda@gufi.org>
To: bug-followup@freebsd.org
Cc: dds@freebsd.org
Subject: kern/73821
Date: Fri, 8 Apr 2005 22:11:24 +0200

 --QHhm1I6mwQR20oIa
 Content-Type: text/plain; charset=us-ascii
 Content-Disposition: inline
 Content-Transfer-Encoding: quoted-printable
 
 This doesn't seems to have been MFCed neither to RELENG_5 nor to
 RELENG_4 (if it's possible).
 After the merge had happened, this PR can be closed.
 Thank you
 Best Regards
 --=20
 Rionda aka Matteo Riondato
 Disinformato per default
 G.U.F.I. Staff Member (http://www.gufi.org)
 FreeSBIE Developer (http://www.freesbie.org)
 
 --QHhm1I6mwQR20oIa
 Content-Type: application/pgp-signature
 Content-Disposition: inline
 
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.0 (FreeBSD)
 
 iD8DBQFCVuVs2Mp4pR7Fa+wRAnVvAKCl2A+uez/hdUd6GXoOJe954ceIQQCg1Vqv
 RFmFqNO7S3JxRc2eZ7e1fmM=
 =RPNz
 -----END PGP SIGNATURE-----
 
 --QHhm1I6mwQR20oIa--

From: Diomidis Spinellis <dds@aueb.gr>
To: Matteo Riondato <rionda@gufi.org>
Cc: bug-followup@FreeBSD.ORG, dds@FreeBSD.ORG
Subject: Re: kern/73821
Date: Sat, 09 Apr 2005 00:54:46 +0400

 Matteo Riondato wrote:
 
 > This doesn't seems to have been MFCed neither to RELENG_5 nor to
 > RELENG_4 (if it's possible).
 > After the merge had happened, this PR can be closed.
 
 I am looking into it.  Thanks!
State-Changed-From-To: patched->closed 
State-Changed-By: dds 
State-Changed-When: Fri Apr 8 21:45:52 GMT 2005 
State-Changed-Why:  
MFC to RELENG_4, RELENG_5 

http://www.freebsd.org/cgi/query-pr.cgi?pr=73821 
>Unformatted:
