From owner-svn-src-all@FreeBSD.ORG  Sun Jul 28 06:59:29 2013
Return-Path: <owner-svn-src-all@FreeBSD.ORG>
Delivered-To: svn-src-all@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
 (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTP id C471E811;
 Sun, 28 Jul 2013 06:59:29 +0000 (UTC) (envelope-from kib@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
 [IPv6:2001:1900:2254:2068::e6a:0])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (No client certificate requested)
 by mx1.freebsd.org (Postfix) with ESMTPS id B1E88231F;
 Sun, 28 Jul 2013 06:59:29 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
 by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id r6S6xTKd041741;
 Sun, 28 Jul 2013 06:59:29 GMT (envelope-from kib@svn.freebsd.org)
Received: (from kib@localhost)
 by svn.freebsd.org (8.14.7/8.14.5/Submit) id r6S6xT6G041740;
 Sun, 28 Jul 2013 06:59:29 GMT (envelope-from kib@svn.freebsd.org)
Message-Id: <201307280659.r6S6xT6G041740@svn.freebsd.org>
From: Konstantin Belousov <kib@FreeBSD.org>
Date: Sun, 28 Jul 2013 06:59:29 +0000 (UTC)
To: src-committers@freebsd.org, svn-src-all@freebsd.org,
 svn-src-head@freebsd.org
Subject: svn commit: r253737 - head/sys/kern
X-SVN-Group: head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-src-all@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: "SVN commit messages for the entire src tree \(except for &quot;
 user&quot; and &quot; projects&quot; \)" <svn-src-all.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/svn-src-all>,
 <mailto:svn-src-all-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-src-all>
List-Post: <mailto:svn-src-all@freebsd.org>
List-Help: <mailto:svn-src-all-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/svn-src-all>,
 <mailto:svn-src-all-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 28 Jul 2013 06:59:29 -0000

Author: kib
Date: Sun Jul 28 06:59:29 2013
New Revision: 253737
URL: http://svnweb.freebsd.org/changeset/base/253737

Log:
  When creation of the v_pollinfo raced and our instance of vpollinfo
  must be destroyed, knlist_clear() and seldrain() calls could be
  avoided, since vpollinfo was not used.  More, the knlist_clear()
  calling protocol requires the knlist locked, which is not true at the
  call site.
  
  Split the destruction into the helper destroy_vpollinfo_free(), and
  call it when raced, instead of destroy_vpollinfo().
  
  Reported and tested by:	pho
  Sponsored by:	The FreeBSD Foundation
  MFC after:   3 days

Modified:
  head/sys/kern/vfs_subr.c

Modified: head/sys/kern/vfs_subr.c
==============================================================================
--- head/sys/kern/vfs_subr.c	Sun Jul 28 06:16:12 2013	(r253736)
+++ head/sys/kern/vfs_subr.c	Sun Jul 28 06:59:29 2013	(r253737)
@@ -3453,16 +3453,23 @@ vfs_msync(struct mount *mp, int flags)
 }
 
 static void
-destroy_vpollinfo(struct vpollinfo *vi)
+destroy_vpollinfo_free(struct vpollinfo *vi)
 {
 
-	knlist_clear(&vi->vpi_selinfo.si_note, 1);
-	seldrain(&vi->vpi_selinfo);
 	knlist_destroy(&vi->vpi_selinfo.si_note);
 	mtx_destroy(&vi->vpi_lock);
 	uma_zfree(vnodepoll_zone, vi);
 }
 
+static void
+destroy_vpollinfo(struct vpollinfo *vi)
+{
+
+	knlist_clear(&vi->vpi_selinfo.si_note, 1);
+	seldrain(&vi->vpi_selinfo);
+	destroy_vpollinfo_free(vi);
+}
+
 /*
  * Initalize per-vnode helper structure to hold poll-related state.
  */
@@ -3480,7 +3487,7 @@ v_addpollinfo(struct vnode *vp)
 	VI_LOCK(vp);
 	if (vp->v_pollinfo != NULL) {
 		VI_UNLOCK(vp);
-		destroy_vpollinfo(vi);
+		destroy_vpollinfo_free(vi);
 		return;
 	}
 	vp->v_pollinfo = vi;