Do not dereference cdev->si_cdevsw, use the dev_refthread() to properly

obtain the reference. In particular, this fixes the panic reported in
the PR. Remove the comments stating that this needs to be done.

PR:	kern/119422
MFC after:	1 week

1 files changed, 12 insertions, 5 deletions

diff --git a/sys/fs/devfs/devfs_rule.c b/sys/fs/devfs/devfs_rule.c
index f6aef03..bb7ebd1 100644
--- a/sys/fs/devfs/devfs_rule.c
+++ b/sys/fs/devfs/devfs_rule.c
@@ -527,6 +527,7 @@ devfs_rule_match(struct devfs_krule *dk, struct devfs_dirent *de)
 {
 	struct devfs_rule *dr = &dk->dk_rule;
 	struct cdev *dev;
+	struct cdevsw *dsw;
 
 	dev = devfs_rule_getdev(de);
 	/*
@@ -540,13 +541,19 @@ devfs_rule_match(struct devfs_krule *dk, struct devfs_dirent *de)
 	 * They're actually testing to see whether the condition does
 	 * *not* match, since the default is to assume the rule should
 	 * be run (such as if there are no conditions).
-	 *
-	 * XXX: lacks threadref on dev
 	 */
-	if (dr->dr_icond & DRC_DSWFLAGS)
-		if (dev == NULL ||
-		    (dev->si_devsw->d_flags & dr->dr_dswflags) == 0)
+	if (dr->dr_icond & DRC_DSWFLAGS) {
+		if (dev == NULL)
+			return (0);
+		dsw = dev_refthread(dev);
+		if (dsw == NULL)
+			return (0);
+		if ((dsw->d_flags & dr->dr_dswflags) == 0) {
+			dev_relthread(dev);
 			return (0);
+		}
+		dev_relthread(dev);
+	}
 	if (dr->dr_icond & DRC_PATHPTRN)
 		if (!devfs_rule_matchpath(dk, de))
 			return (0);