diff options
| author | kib <kib@FreeBSD.org> | 2014-03-12 15:13:57 +0000 |
|---|---|---|
| committer | kib <kib@FreeBSD.org> | 2014-03-12 15:13:57 +0000 |
| commit | e4111a6b71f8dc06602bb1d894ddb649e49d1d7d (patch) | |
| tree | 6045b30bd58f0923d86994d7d935cf50211ee8a3 | |
| parent | d734bed796cbf601324281d481e9906341524f03 (diff) | |
| download | FreeBSD-src-e4111a6b71f8dc06602bb1d894ddb649e49d1d7d.zip FreeBSD-src-e4111a6b71f8dc06602bb1d894ddb649e49d1d7d.tar.gz | |
Do not vdrop() the tmpfs vnode until it is unlocked. The hold
reference might be the last, and then vdrop() would free the vnode.
Reported and tested by: bdrewery
MFC after: 1 week
| -rw-r--r-- | sys/vm/vm_object.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/sys/vm/vm_object.c b/sys/vm/vm_object.c index 1c463ea..1066a9d 100644 --- a/sys/vm/vm_object.c +++ b/sys/vm/vm_object.c @@ -536,17 +536,18 @@ vm_object_deallocate(vm_object_t object) vhold(vp); VM_OBJECT_WUNLOCK(object); vn_lock(vp, LK_EXCLUSIVE | LK_RETRY); - vdrop(vp); VM_OBJECT_WLOCK(object); if (object->type == OBJT_DEAD || object->ref_count != 1) { VM_OBJECT_WUNLOCK(object); VOP_UNLOCK(vp, 0); + vdrop(vp); return; } if ((object->flags & OBJ_TMPFS) != 0) VOP_UNSET_TEXT(vp); VOP_UNLOCK(vp, 0); + vdrop(vp); } if (object->shadow_count == 0 && object->handle == NULL && |
