diff options
| author | Konstantin Belousov <kib@FreeBSD.org> | 2017-02-25 10:38:18 +0000 |
|---|---|---|
| committer | Konstantin Belousov <kib@FreeBSD.org> | 2017-02-25 10:38:18 +0000 |
| commit | aca4bb9112dc98fe2777ef71ebcef4b0e5c75cff (patch) | |
| tree | 60374cd37d42676571da6c54d01972ee15dea71a /sys/kern/subr_trap.c | |
| parent | d360b49b1dd52310cc750f86e0c793f3b51f6023 (diff) | |
| download | src-aca4bb9112dc98fe2777ef71ebcef4b0e5c75cff.tar.gz src-aca4bb9112dc98fe2777ef71ebcef4b0e5c75cff.zip | |
Do not leak mount references for dying threads.
Thread might create a condition for delayed SU cleanup, which creates
a reference to the mount point in td_su, but exit without returning
through userret(), e.g. when terminating due to single-threading or
process exit. In this case, td_su reference is not dropped and mount
point cannot be freed.
Handle the situation by clearing td_su also in the thread destructor
and in exit1(). softdep_ast_cleanup() has to receive the thread as
argument, since e.g. thread destructor is executed in different
context.
Reported and tested by: pho
Sponsored by: The FreeBSD Foundation
MFC after: 2 weeks
Notes
Notes:
svn path=/head/; revision=314253
Diffstat (limited to 'sys/kern/subr_trap.c')
| -rw-r--r-- | sys/kern/subr_trap.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/sys/kern/subr_trap.c b/sys/kern/subr_trap.c index 14a9e856fed9..d86d5db2ceb7 100644 --- a/sys/kern/subr_trap.c +++ b/sys/kern/subr_trap.c @@ -86,7 +86,7 @@ __FBSDID("$FreeBSD$"); #include <security/mac/mac_framework.h> -void (*softdep_ast_cleanup)(void); +void (*softdep_ast_cleanup)(struct thread *); /* * Define the code needed before returning to user mode, for trap and @@ -128,8 +128,8 @@ userret(struct thread *td, struct trapframe *frame) #ifdef KTRACE KTRUSERRET(td); #endif - if (softdep_ast_cleanup != NULL) - softdep_ast_cleanup(); + td_softdep_cleanup(td); + MPASS(td->td_su == NULL); /* * If this thread tickled GEOM, we need to wait for the giggling to |