svn commit: r295613 - stable/10/sys/fs/devfs

[Konstantin Belousov]

Author: kib
Date: Sun Feb 14 17:21:19 2016
New Revision: 295613
URL: https://svnweb.freebsd.org/changeset/base/295613

Log:
  MFC r294595:
  When devfs dirent is freed, a vnode might still keep a pointer to it,
  apparently.  Interlock and clear the pointer to avoid free memory
  dereference.
  
  Approved by:	re (marius)

Modified:
  stable/10/sys/fs/devfs/devfs_devs.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/sys/fs/devfs/devfs_devs.c
==============================================================================
--- stable/10/sys/fs/devfs/devfs_devs.c	Sun Feb 14 16:38:32 2016	(r295612)
+++ stable/10/sys/fs/devfs/devfs_devs.c	Sun Feb 14 17:21:19 2016	(r295613)
@@ -304,6 +304,13 @@ devfs_vmkdir(struct devfs_mount *dmp, ch
 void
 devfs_dirent_free(struct devfs_dirent *de)
 {
+	struct vnode *vp;
+
+	vp = de->de_vnode;
+	mtx_lock(&devfs_de_interlock);
+	if (vp != NULL && vp->v_data == de)
+		vp->v_data = NULL;
+	mtx_unlock(&devfs_de_interlock);
 	free(de, M_DEVFS3);
 }