From owner-svn-src-head@FreeBSD.ORG Wed Jan 14 22:07:14 2015 Return-Path: Delivered-To: svn-src-head@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 6D02DF22; Wed, 14 Jan 2015 22:07:14 +0000 (UTC) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 5812B5FD; Wed, 14 Jan 2015 22:07:14 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.9/8.14.9) with ESMTP id t0EM7EEG041545; Wed, 14 Jan 2015 22:07:14 GMT (envelope-from hselasky@FreeBSD.org) Received: (from hselasky@localhost) by svn.freebsd.org (8.14.9/8.14.9/Submit) id t0EM7Dfn041543; Wed, 14 Jan 2015 22:07:13 GMT (envelope-from hselasky@FreeBSD.org) Message-Id: <201501142207.t0EM7Dfn041543@svn.freebsd.org> X-Authentication-Warning: svn.freebsd.org: hselasky set sender to hselasky@FreeBSD.org using -f From: Hans Petter Selasky Date: Wed, 14 Jan 2015 22:07:13 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r277199 - in head/sys: fs/devfs kern X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Jan 2015 22:07:14 -0000 Author: hselasky Date: Wed Jan 14 22:07:13 2015 New Revision: 277199 URL: https://svnweb.freebsd.org/changeset/base/277199 Log: Avoid race with "dev_rel()" when using the recently added "delist_dev()" function. Make sure the character device structure doesn't go away until the end of the "destroy_dev()" function due to concurrently running cleanup code inside "devfs_populate()". MFC after: 1 week Reported by: dchagin@ Modified: head/sys/fs/devfs/devfs_devs.c head/sys/kern/kern_conf.c Modified: head/sys/fs/devfs/devfs_devs.c ============================================================================== --- head/sys/fs/devfs/devfs_devs.c Wed Jan 14 22:05:57 2015 (r277198) +++ head/sys/fs/devfs/devfs_devs.c Wed Jan 14 22:07:13 2015 (r277199) @@ -137,6 +137,12 @@ devfs_alloc(int flags) vfs_timestamp(&ts); cdev->si_atime = cdev->si_mtime = cdev->si_ctime = ts; cdev->si_cred = NULL; + /* + * Avoid race with dev_rel() by setting the initial + * reference count to 1. This last reference is taken + * by the destroy_dev() function. + */ + cdev->si_refcount = 1; return (cdev); } Modified: head/sys/kern/kern_conf.c ============================================================================== --- head/sys/kern/kern_conf.c Wed Jan 14 22:05:57 2015 (r277198) +++ head/sys/kern/kern_conf.c Wed Jan 14 22:07:13 2015 (r277199) @@ -1048,8 +1048,6 @@ destroy_devl(struct cdev *dev) /* Remove name marking */ dev->si_flags &= ~SI_NAMED; - dev->si_refcount++; /* Avoid race with dev_rel() */ - /* If we are a child, remove us from the parents list */ if (dev->si_flags & SI_CHILD) { LIST_REMOVE(dev, si_siblings);