Date: Mon, 17 Mar 2008 13:17:10 +0000 (UTC) From: Konstantin Belousov <kib@FreeBSD.org> To: src-committers@FreeBSD.org, cvs-src@FreeBSD.org, cvs-all@FreeBSD.org Subject: cvs commit: src/sys/kern kern_conf.c src/sys/sys conf.h Message-ID: <200803171317.m2HDHAZ9079210@repoman.freebsd.org>
next in thread | raw e-mail | index | archive | help
kib 2008-03-17 13:17:10 UTC
FreeBSD src repository
Modified files:
sys/kern kern_conf.c
sys/sys conf.h
Log:
Fix two races in the handling of the d_gianttrick for the D_NEEDGIANT
drivers.
In the giant_XXX wrappers for the device methods of the D_NEEDGIANT
drivers, do not dereference the cdev->si_devsw. It is racing with
the destroy_devl() clearing of the si_devsw. Instead, use the
dev_refthread() and return ENXIO for the destroyed device. [1]
The check for the D_INIT in the prep_cdevsw() was not synchronized with
the call of the fini_cdevsw() in destroy_devl(), that under rapid device
creation/destruction may result in the use of uninitialized cdevsw [2].
Change the protocol for the prep_cdevsw(), requiring it to be called
under dev_mtx, where the check for D_INIT is done.
Do not free the memory allocated for the gianttrick cdevsw while holding
the dev_mtx, put it into the free list to be freed later. Reuse the
d_gianttrick pointer to keep the size and layout of the struct cdevsw
(requested by phk). Free the memory in the dev_unlock_and_free(), and do
all the free after the dev_mtx is dropped (suggested by jhb).
Reported by: bsdimp + many [1], pho [2]
Reviewed by: phk, jhb
Tested by: pho
MFC after: 1 week
Revision Changes Path
1.210 +121 -35 src/sys/kern/kern_conf.c
1.236 +6 -1 src/sys/sys/conf.h
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200803171317.m2HDHAZ9079210>