DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2212

ttm_exit() deadlocks forever in uninterruptible wait_event on condition that can never become true

Summary

ttm_exit() ends with wait_event(exit_q atomic_read(&device_released)==1) but the only code that ever sets device_released=1 and wakes exit_q (the .release callback ttm_drm_class_device_release) is wrapped in #if 0 (lines 40-53) and never compiled. After successful ttm_init the success path explicitly sets device_released=0 (line 77) and no other kernel code path can ever flip it to 1 (verified wake_up_all(&exit_q) and atomic_set(&device_released 1) appear nowhere else in sys/). At module unload (kldunload) and at system shutdown via SYSUNINIT the calling thread enters TASK_UNINTERRUPTIBLE tsleep with no PCATCH and loops forever in hz-timeout retry inside __wait_event_common becoming unkillable D-state process that wedges module linker. Root cause: Linux upstream TTM design relies on device model device_unregister drops last ref and struct device .release callback sets device_released=1 and calls wake_up_all. DragonFly port broke this in two ways: (1) disabled .release via #if 0 (2) drm_class_device_unregister is no-op never drops ref. Author flagged uncertainty in comment lines 93-96 (Not sure this is 100% needed).

Discussion (0)

No comments yet.