diff options
| author | hselasky <hselasky@FreeBSD.org> | 2015-01-14 22:07:13 +0000 |
|---|---|---|
| committer | hselasky <hselasky@FreeBSD.org> | 2015-01-14 22:07:13 +0000 |
| commit | b04cbf0c36a250a198bd3590209a1950e382664f (patch) | |
| tree | 77fbb7d5d403fb7634749cf5b96fa3188c3de18b | |
| parent | ebab1754a3d2609947e5d0562d678979a6040614 (diff) | |
| download | FreeBSD-src-b04cbf0c36a250a198bd3590209a1950e382664f.zip FreeBSD-src-b04cbf0c36a250a198bd3590209a1950e382664f.tar.gz | |
Avoid race with "dev_rel()" when using the recently added
"delist_dev()" function. Make sure the character device structure
doesn't go away until the end of the "destroy_dev()" function due to
concurrently running cleanup code inside "devfs_populate()".
MFC after: 1 week
Reported by: dchagin@
| -rw-r--r-- | sys/fs/devfs/devfs_devs.c | 6 | ||||
| -rw-r--r-- | sys/kern/kern_conf.c | 2 |
2 files changed, 6 insertions, 2 deletions
diff --git a/sys/fs/devfs/devfs_devs.c b/sys/fs/devfs/devfs_devs.c index a408725..294bd62 100644 --- a/sys/fs/devfs/devfs_devs.c +++ b/sys/fs/devfs/devfs_devs.c @@ -137,6 +137,12 @@ devfs_alloc(int flags) vfs_timestamp(&ts); cdev->si_atime = cdev->si_mtime = cdev->si_ctime = ts; cdev->si_cred = NULL; + /* + * Avoid race with dev_rel() by setting the initial + * reference count to 1. This last reference is taken + * by the destroy_dev() function. + */ + cdev->si_refcount = 1; return (cdev); } diff --git a/sys/kern/kern_conf.c b/sys/kern/kern_conf.c index 8b1fdc1..bcd6fb9 100644 --- a/sys/kern/kern_conf.c +++ b/sys/kern/kern_conf.c @@ -1048,8 +1048,6 @@ destroy_devl(struct cdev *dev) /* Remove name marking */ dev->si_flags &= ~SI_NAMED; - dev->si_refcount++; /* Avoid race with dev_rel() */ - /* If we are a child, remove us from the parents list */ if (dev->si_flags & SI_CHILD) { LIST_REMOVE(dev, si_siblings); |
