From 186abbd7276d4d6f6b635c5bbd55d969c8f4f9d8 Mon Sep 17 00:00:00 2001
From: John Baldwin <jhb@FreeBSD.org>
Date: Thu, 27 Jul 2006 19:58:18 +0000
Subject: [PATCH] Write a magic value into mtx_lock when destroying a mutex
 that will force all other mtx_lock() operations to block.  Previously, when
 the mutex was destroyed, it would still have a valid value in mtx_lock():
 either the unowned cookie, which would allow a subsequent mtx_lock() to
 succeed, or a pointer to the thread who destroyed the mutex if the mutex was
 locked when it was destroyed.

MFC after:	3 days
---
 sys/kern/kern_mutex.c | 11 +++++++++++
 sys/sys/mutex.h       |  5 +++++
 2 files changed, 16 insertions(+)

diff --git a/sys/kern/kern_mutex.c b/sys/kern/kern_mutex.c
index 634fa9d8262..04368e51708 100644
--- a/sys/kern/kern_mutex.c
+++ b/sys/kern/kern_mutex.c
@@ -276,6 +276,8 @@ _mtx_lock_flags(struct mtx *m, int opts, const char *file, int line)
 {
 
 	MPASS(curthread != NULL);
+	KASSERT(m->mtx_lock != MTX_DESTROYED,
+	    ("mtx_lock() of destroyed mutex @ %s:%d", file, line));
 	KASSERT(LOCK_CLASS(&m->mtx_object) == &lock_class_mtx_sleep,
 	    ("mtx_lock() of spin mutex %s @ %s:%d", m->mtx_object.lo_name,
 	    file, line));
@@ -301,6 +303,8 @@ _mtx_unlock_flags(struct mtx *m, int opts, const char *file, int line)
 {
 
 	MPASS(curthread != NULL);
+	KASSERT(m->mtx_lock != MTX_DESTROYED,
+	    ("mtx_unlock() of destroyed mutex @ %s:%d", file, line));
 	KASSERT(LOCK_CLASS(&m->mtx_object) == &lock_class_mtx_sleep,
 	    ("mtx_unlock() of spin mutex %s @ %s:%d", m->mtx_object.lo_name,
 	    file, line));
@@ -380,6 +384,8 @@ _mtx_lock_spin_flags(struct mtx *m, int opts, const char *file, int line)
 {
 
 	MPASS(curthread != NULL);
+	KASSERT(m->mtx_lock != MTX_DESTROYED,
+	    ("mtx_lock_spin() of destroyed mutex @ %s:%d", file, line));
 	KASSERT(LOCK_CLASS(&m->mtx_object) == &lock_class_mtx_spin,
 	    ("mtx_lock_spin() of sleep mutex %s @ %s:%d",
 	    m->mtx_object.lo_name, file, line));
@@ -396,6 +402,8 @@ _mtx_unlock_spin_flags(struct mtx *m, int opts, const char *file, int line)
 {
 
 	MPASS(curthread != NULL);
+	KASSERT(m->mtx_lock != MTX_DESTROYED,
+	    ("mtx_unlock_spin() of destroyed mutex @ %s:%d", file, line));
 	KASSERT(LOCK_CLASS(&m->mtx_object) == &lock_class_mtx_spin,
 	    ("mtx_unlock_spin() of sleep mutex %s @ %s:%d",
 	    m->mtx_object.lo_name, file, line));
@@ -417,6 +425,8 @@ _mtx_trylock(struct mtx *m, int opts, const char *file, int line)
 	int rval;
 
 	MPASS(curthread != NULL);
+	KASSERT(m->mtx_lock != MTX_DESTROYED,
+	    ("mtx_trylock() of destroyed mutex @ %s:%d", file, line));
 	KASSERT(LOCK_CLASS(&m->mtx_object) == &lock_class_mtx_sleep,
 	    ("mtx_trylock() of spin mutex %s @ %s:%d", m->mtx_object.lo_name,
 	    file, line));
@@ -885,6 +895,7 @@ mtx_destroy(struct mtx *m)
 		    __LINE__);
 	}
 
+	m->mtx_lock = MTX_DESTROYED;
 	lock_destroy(&m->mtx_object);
 }
 
diff --git a/sys/sys/mutex.h b/sys/sys/mutex.h
index a28ea3123b0..1a13e1a61a2 100644
--- a/sys/sys/mutex.h
+++ b/sys/sys/mutex.h
@@ -73,6 +73,11 @@
 #define MTX_UNOWNED	0x00000004	/* Cookie for free mutex */
 #define	MTX_FLAGMASK	(MTX_RECURSED | MTX_CONTESTED | MTX_UNOWNED)
 
+/*
+ * Value stored in mutex->mtx_lock to denote a destroyed mutex.
+ */
+#define	MTX_DESTROYED	(MTX_CONTESTED | MTX_UNOWNED)
+
 #endif	/* _KERNEL */
 
 #ifndef LOCORE