Do not dereference cdev->si_cdevsw, use the dev_refthread() to properly

obtain the reference. In particular, this fixes the panic reported in
the PR. Remove the comments stating that this needs to be done.

PR:	kern/119422
MFC after:	1 week

1 files changed, 16 insertions, 4 deletions

diff --git a/sys/vm/vm_mmap.c b/sys/vm/vm_mmap.c
index 8a496a6..f622d99 100644
--- a/sys/vm/vm_mmap.c
+++ b/sys/vm/vm_mmap.c
@@ -1160,6 +1160,7 @@ vm_mmap_vnode(struct thread *td, vm_size_t objsize,
 	void *handle;
 	vm_object_t obj;
 	struct mount *mp;
+	struct cdevsw *dsw;
 	int error, flags, type;
 	int vfslocked;
 
@@ -1190,13 +1191,19 @@ vm_mmap_vnode(struct thread *td, vm_size_t objsize,
 		type = OBJT_DEVICE;
 		handle = vp->v_rdev;
 
-		/* XXX: lack thredref on device */
-		if(vp->v_rdev->si_devsw->d_flags & D_MMAP_ANON) {
+		dsw = dev_refthread(handle);
+		if (dsw == NULL) {
+			error = ENXIO;
+			goto done;
+		}
+		if (dsw->d_flags & D_MMAP_ANON) {
+			dev_relthread(handle);
 			*maxprotp = VM_PROT_ALL;
 			*flagsp |= MAP_ANON;
 			error = 0;
 			goto done;
 		}
+		dev_relthread(handle);
 		/*
 		 * cdevs does not provide private mappings of any kind.
 		 */
@@ -1273,16 +1280,21 @@ vm_mmap_cdev(struct thread *td, vm_size_t objsize,
     struct cdev *cdev, vm_ooffset_t foff, vm_object_t *objp)
 {
 	vm_object_t obj;
+	struct cdevsw *dsw;
 	int flags;
 
 	flags = *flagsp;
 
-	/* XXX: lack thredref on device */
-	if (cdev->si_devsw->d_flags & D_MMAP_ANON) {
+	dsw = dev_refthread(cdev);
+	if (dsw == NULL)
+		return (ENXIO);
+	if (dsw->d_flags & D_MMAP_ANON) {
+		dev_relthread(cdev);
 		*maxprotp = VM_PROT_ALL;
 		*flagsp |= MAP_ANON;
 		return (0);
 	}
+	dev_relthread(cdev);
 	/*
 	 * cdevs does not provide private mappings of any kind.
 	 */