diff options
| author | kib <kib@FreeBSD.org> | 2009-07-09 18:54:38 +0000 |
|---|---|---|
| committer | kib <kib@FreeBSD.org> | 2009-07-09 18:54:38 +0000 |
| commit | a837257b3675ecb66b023adaebc750d3c8934246 (patch) | |
| tree | ed160a63ca78b5dcb3bb9302bcca80f888c543af /sys/kern | |
| parent | ed780ef7ed1411bab0e3d58ef5405c6da749a526 (diff) | |
| download | FreeBSD-src-a837257b3675ecb66b023adaebc750d3c8934246.zip FreeBSD-src-a837257b3675ecb66b023adaebc750d3c8934246.tar.gz | |
The control terminal revocation at the session leader exit does not
correctly checks for reclaimed vnode, possibly calling VOP_REVOKE for
such vnode. If the terminal is already revoked, or devfs mount was
forcibly unmounted, the revocation of doomed ctty vnode causes panic.
Reported and tested by: lstewart
Approved by: re (kensmith)
MFC after: 2 weeks
Diffstat (limited to 'sys/kern')
| -rw-r--r-- | sys/kern/kern_exit.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/sys/kern/kern_exit.c b/sys/kern/kern_exit.c index 450aab6..cb6e7b2 100644 --- a/sys/kern/kern_exit.c +++ b/sys/kern/kern_exit.c @@ -334,10 +334,11 @@ exit1(struct thread *td, int rv) tty_unlock(tp); } - if (ttyvp != NULL && ttyvp->v_type != VBAD) { + if (ttyvp != NULL) { sx_xunlock(&proctree_lock); - VOP_LOCK(ttyvp, LK_EXCLUSIVE); - VOP_REVOKE(ttyvp, REVOKEALL); + vn_lock(ttyvp, LK_EXCLUSIVE | LK_RETRY); + if (ttyvp->v_type != VBAD) + VOP_REVOKE(ttyvp, REVOKEALL); VOP_UNLOCK(ttyvp, 0); sx_xlock(&proctree_lock); } |
