cvs commit: src/sys/kern kern_exit.c vfs_subr.c vfs_vnops.c src/sys/vfs/specfs spec_vnops.c

[Joerg Sonnenberger]

On Mon, Jun 14, 2004 at 05:30:55PM -0700, Matthew Dillon wrote:
> dillon      2004/06/14 17:30:55 PDT
> 
> DragonFly src repository
> 
>   Modified files:
>     sys/kern             kern_exit.c vfs_subr.c vfs_vnops.c 
>     sys/vfs/specfs       spec_vnops.c 
>   Log:
>   Fix a race with the clearing of p->p_session->s_ttyvp.  NULL the pointer
>   out before calling vrele() rather then afteve been revoked

@@ -253,12 +259,16 @@
                                 * The tty could have been revoked
                                 * if we blocked.
                                 */
-                               if (sp->s_ttyvp)
-                                       VOP_REVOKE(sp->s_ttyvp, REVOKEALL);
+                               if ((vp = sp->s_ttyvp) != NULL) {
+                                       sp->s_ttyvp = NULL;
+                                       VOP_REVOKE(vp, REVOKEALL);
+                                       vrele(vp);
+                               }
                        }
-                       if (sp->s_ttyvp)
+                       if ((vp = sp->s_ttyvp) != NULL) {
+                               sp->s_ttyvp = NULL;
                                vrele(sp->s_ttyvp);
-                       sp->s_ttyvp = NULL;
+                       }
                        /*
                         * s_ttyp is not zero'd; we use this to indicate
                         * that the session once had a controlling terminal.

This is bogus because vrele(vp) has an KASSERT for vp != NULL. I can
hit it pretty easy.

Joerg