From owner-svn-src-head@FreeBSD.ORG  Tue Jun 11 15:37:07 2013
Return-Path: <owner-svn-src-head@FreeBSD.ORG>
Delivered-To: svn-src-head@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
 by hub.freebsd.org (Postfix) with ESMTP id D5AA27EF;
 Tue, 11 Jun 2013 15:37:07 +0000 (UTC) (envelope-from jhb@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
 [IPv6:2001:1900:2254:2068::e6a:0])
 by mx1.freebsd.org (Postfix) with ESMTP id C83401AE4;
 Tue, 11 Jun 2013 15:37:07 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
 by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id r5BFb7L9087201;
 Tue, 11 Jun 2013 15:37:07 GMT (envelope-from jhb@svn.freebsd.org)
Received: (from jhb@localhost)
 by svn.freebsd.org (8.14.7/8.14.5/Submit) id r5BFb7Tj087199;
 Tue, 11 Jun 2013 15:37:07 GMT (envelope-from jhb@svn.freebsd.org)
Message-Id: <201306111537.r5BFb7Tj087199@svn.freebsd.org>
From: John Baldwin <jhb@FreeBSD.org>
Date: Tue, 11 Jun 2013 15:37:07 +0000 (UTC)
To: src-committers@freebsd.org, svn-src-all@freebsd.org,
 svn-src-head@freebsd.org
Subject: svn commit: r251617 - head/sys/ofed/include/linux
X-SVN-Group: head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-src-head@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for the src tree for head/-current
 <svn-src-head.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/svn-src-head>,
 <mailto:svn-src-head-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-src-head>
List-Post: <mailto:svn-src-head@freebsd.org>
List-Help: <mailto:svn-src-head-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/svn-src-head>,
 <mailto:svn-src-head-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 11 Jun 2013 15:37:07 -0000

Author: jhb
Date: Tue Jun 11 15:37:07 2013
New Revision: 251617
URL: http://svnweb.freebsd.org/changeset/base/251617

Log:
  Store a reference to the vnode associated with a file descriptor in the
  linux_file structure and use it instead of directly accessing td_fpop
  when destroying the linux_file structure.  The td_fpop pointer is not
  valid when a cdevpriv destructor is run, and the type-specific close
  method has already been called, so f_vnode may not be valid (and the
  vnode might have been recycled without our own reference).
  
  Tested by:	Julian Stecklina <jsteckli@os.inf.tu-dresden.de>
  MFC after:	1 week

Modified:
  head/sys/ofed/include/linux/fs.h
  head/sys/ofed/include/linux/linux_compat.c

Modified: head/sys/ofed/include/linux/fs.h
==============================================================================
--- head/sys/ofed/include/linux/fs.h	Tue Jun 11 10:06:07 2013	(r251616)
+++ head/sys/ofed/include/linux/fs.h	Tue Jun 11 15:37:07 2013	(r251617)
@@ -73,6 +73,7 @@ struct linux_file {
 	struct dentry	f_dentry_store;
 	struct selinfo	f_selinfo;
 	struct sigio	*f_sigio;
+	struct vnode	*f_vnode;
 };
 
 #define	file		linux_file

Modified: head/sys/ofed/include/linux/linux_compat.c
==============================================================================
--- head/sys/ofed/include/linux/linux_compat.c	Tue Jun 11 10:06:07 2013	(r251616)
+++ head/sys/ofed/include/linux/linux_compat.c	Tue Jun 11 15:37:07 2013	(r251617)
@@ -212,7 +212,8 @@ linux_file_dtor(void *cdp)
 	struct linux_file *filp;
 
 	filp = cdp;
-	filp->f_op->release(curthread->td_fpop->f_vnode, filp);
+	filp->f_op->release(filp->f_vnode, filp);
+	vdrop(filp->f_vnode);
 	kfree(filp);
 }
 
@@ -232,6 +233,8 @@ linux_dev_open(struct cdev *dev, int ofl
 	filp->f_dentry = &filp->f_dentry_store;
 	filp->f_op = ldev->ops;
 	filp->f_flags = file->f_flag;
+	vhold(file->f_vnode);
+	filp->f_vnode = file->f_vnode;
 	if (filp->f_op->open) {
 		error = -filp->f_op->open(file->f_vnode, filp);
 		if (error) {