svn commit: r228361 - head/sys/fs/devfs

[John Baldwin]

Author: jhb
Date: Fri Dec  9 17:49:34 2011
New Revision: 228361
URL: http://svn.freebsd.org/changeset/base/228361

Log:
  Explicitly use curthread while manipulating td_fpop during last close
  of a devfs file descriptor in devfs_close_f().  The passed in td argument
  may be NULL if the close was invoked by garbage collection of open
  file descriptors in pending control messages in the socket buffer of a
  UNIX domain socket after it was closed.
  
  PR:		kern/151758
  Submitted by:	Andrey Shidakov  andrey shidakov ru
  Submitted by:	Ruben van Staveren  ruben verweg com
  Reviewed by:	kib
  MFC after:	2 weeks

Modified:
  head/sys/fs/devfs/devfs_vnops.c

Modified: head/sys/fs/devfs/devfs_vnops.c
==============================================================================
--- head/sys/fs/devfs/devfs_vnops.c	Fri Dec  9 17:19:41 2011	(r228360)
+++ head/sys/fs/devfs/devfs_vnops.c	Fri Dec  9 17:49:34 2011	(r228361)
@@ -602,10 +602,14 @@ devfs_close_f(struct file *fp, struct th
 	int error;
 	struct file *fpop;
 
-	fpop = td->td_fpop;
-	td->td_fpop = fp;
+	/*
+	 * NB: td may be NULL if this descriptor is closed due to
+	 * garbage collection from a closed UNIX domain socket.
+	 */
+	fpop = curthread->td_fpop;
+	curthread->td_fpop = fp;
 	error = vnops.fo_close(fp, td);
-	td->td_fpop = fpop;
+	curthread->td_fpop = fpop;
 
 	/*
 	 * The f_cdevpriv cannot be assigned non-NULL value while we