1
0
mirror of https://git.FreeBSD.org/src.git synced 2024-12-25 11:37:56 +00:00
freebsd/sys/rpc
Rick Macklem 2ba476324b Both a crash reported on freebsd-current on Oct. 18 under the
subject heading "mtx_lock() of destroyed mutex on NFS" and
PR# 156168 appear to be caused by clnt_dg_destroy() closing
down the socket prematurely. When to close down the socket
is controlled by a reference count (cs_refs), but clnt_dg_create()
checks for sb_upcall being non-NULL to decide if a new socket
is needed. I believe the crashes were caused by the following race:
  clnt_dg_destroy() finds cs_refs == 0 and decides to delete socket
  clnt_dg_destroy() then loses race with clnt_dg_create() for
    acquisition of the SOCKBUF_LOCK()
  clnt_dg_create() finds sb_upcall != NULL and increments cs_refs to 1
  clnt_dg_destroy() then acquires SOCKBUF_LOCK(), sets sb_upcall to
    NULL and destroys socket

This patch fixes the above race by changing clnt_dg_destroy() so
that it acquires SOCKBUF_LOCK() before testing cs_refs.

Tested by:	bz
PR:		156168
Reviewed by:	dfr
MFC after:	2 weeks
2011-11-03 14:38:03 +00:00
..
rpcsec_gss Remove an extraneous "already" from a comment introduced by r226081. 2011-10-07 13:16:21 +00:00
auth_none.c
auth_unix.c
auth.h
authunix_prot.c
clnt_dg.c Both a crash reported on freebsd-current on Oct. 18 under the 2011-11-03 14:38:03 +00:00
clnt_rc.c
clnt_stat.h
clnt_vc.c
clnt.h
getnetconfig.c
netconfig.h
nettype.h
pmap_prot.h
replay.c
replay.h
rpc_callmsg.c
rpc_com.h
rpc_generic.c
rpc_msg.h
rpc_prot.c
rpc.h
rpcb_clnt.c
rpcb_clnt.h
rpcb_prot.c
rpcb_prot.h
rpcm_subs.h
rpcsec_gss.h
svc_auth_unix.c
svc_auth.c
svc_auth.h
svc_dg.c
svc_generic.c
svc_vc.c
svc.c
svc.h
types.h
xdr.h