If we fail to write to a vnode during a ktrace write, then we drop all

other references to that vnode as a trace vnode in other processes as well
as in any pending requests on the todo list.  Thus, it is possible for a
ktrace request structure to have a NULL ktr_vp when it is destroyed in
ktr_freerequest().  We shouldn't call vrele() on the vnode in that case.

Reported by:	bde

1 files changed, 5 insertions, 3 deletions

diff --git a/sys/kern/kern_ktrace.c b/sys/kern/kern_ktrace.c
index d38a0ce..5a40e09 100644
--- a/sys/kern/kern_ktrace.c
+++ b/sys/kern/kern_ktrace.c
@@ -271,9 +271,11 @@ ktr_freerequest(struct ktr_request *req)
 {
 
 	crfree(req->ktr_cred);
-	mtx_lock(&Giant);
-	vrele(req->ktr_vp);
-	mtx_unlock(&Giant);
+	if (req->ktr_vp != NULL) {
+		mtx_lock(&Giant);
+		vrele(req->ktr_vp);
+		mtx_unlock(&Giant);
+	}
 	mtx_lock(&ktrace_mtx);
 	STAILQ_INSERT_HEAD(&ktr_free, req, ktr_list);
 	mtx_unlock(&ktrace_mtx);