kern/89538: [tty] [panic] triggered by "sysctl -a"

[John Baldwin]

The following reply was made to PR kern/89538; it has been noted by GNATS.

From: John Baldwin <jhb at freebsd.org>
To: bug-followup at freebsd.org,
 gkozyrev at gmail.com
Cc:  
Subject: Re: kern/89538: [tty] [panic] triggered by "sysctl -a"
Date: Fri, 19 Oct 2007 10:44:40 -0400

 One thing I noted is that si_usecount is -1 in the most recent gdb output.
 One possible race is that we read vp->v_usecount w/o holding the vnode
 interlock in devfs_reclaim(), so perhaps there is a race between
 VOP_RECLAIM() and some other thread doing a vref() such that the
 cdev is prematurely freed?  Patch is below:
 
 --- //depot/user/jhb/acpipci/fs/devfs/devfs_vnops.c
 +++ /home/john/work/p4/acpipci/fs/devfs/devfs_vnops.c
 @@ -995,17 +995,20 @@
  
  	vnode_destroy_vobject(vp);
  
 +	VI_LOCK(vp);
  	dev_lock();
  	dev = vp->v_rdev;
  	vp->v_rdev = NULL;
  
  	if (dev == NULL) {
  		dev_unlock();
 +		VI_UNLOCK(vp);
  		return (0);
  	}
  
  	dev->si_usecount -= vp->v_usecount;
  	dev_unlock();
 +	VI_UNLOCK(vp);
  	dev_rel(dev);
  	return (0);
  }
 
 -- 
 John Baldwin