From owner-freebsd-current@FreeBSD.ORG  Mon Nov 17 02:06:17 2003
Return-Path: <owner-freebsd-current@FreeBSD.ORG>
Delivered-To: freebsd-current@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id C641B16A4CE
	for <freebsd-current@freebsd.org>;
	Mon, 17 Nov 2003 02:06:17 -0800 (PST)
Received: from milla.ask33.net (milla.ask33.net [217.197.166.60])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 00F7C43F85
	for <freebsd-current@freebsd.org>;
	Mon, 17 Nov 2003 02:06:17 -0800 (PST)
	(envelope-from nick@milla.ask33.net)
Received: by milla.ask33.net (Postfix, from userid 1001)
	id A72B43ABB4E; Mon, 17 Nov 2003 11:06:06 +0100 (CET)
Date: Mon, 17 Nov 2003 11:06:06 +0100
From: Pawel Jakub Dawidek <nick@garage.freebsd.pl>
To: freebsd-current@freebsd.org
Message-ID: <20031117100606.GK85962@garage.freebsd.pl>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-md5;
	protocol="application/pgp-signature"; boundary="WeDu0lr7bteb/II5"
Content-Disposition: inline
X-PGP-Key-URL: http://garage.freebsd.pl/jules.asc
X-OS: FreeBSD 4.8-RELEASE-p9 i386
X-URL: http://garage.freebsd.pl
User-Agent: Mutt/1.5.1i
Subject: Panic after mount() fail.
X-BeenThere: freebsd-current@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Discussions about the use of FreeBSD-current
	<freebsd-current.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-current>
List-Post: <mailto:freebsd-current@freebsd.org>
List-Help: <mailto:freebsd-current-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 17 Nov 2003 10:06:17 -0000
X-List-Received-Date: Mon, 17 Nov 2003 10:06:17 -0000


--WeDu0lr7bteb/II5
Content-Type: text/plain; charset=iso-8859-2
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Hello.

There is a problem with mount(2) failures. It can cause panics.

How-to-repeat.

	# dd if=3D/dev/random of=3D/test.img bs=3D1m count=3D8
	# mdconfig -a -t vnode -f /test.img -u 25
	# mkdir -p /mnt/test
	# mount /dev/md25 /mnt/test
	(fail)
	# mount /dev/md25 /mnt/test
	(panic "Memory modified after free ...")

This is because on failure mutex is not destroyed.

Patch:

--- vfs_mount.c.orig	Sun Nov 16 15:46:56 2003
+++ vfs_mount.c	Sun Nov 16 15:21:48 2003
@@ -1061,6 +1061,7 @@ update:
 			vfs_unbusy(mp, td);
 		else {
 			mp->mnt_vfc->vfc_refcount--;
+			mtx_destroy(&mp->mnt_mtx);
 			vfs_unbusy(mp, td);
 #ifdef MAC
 			mac_destroy_mount(mp);
@@ -1142,6 +1143,7 @@ update:
 		vp->v_iflag &=3D ~VI_MOUNT;
 		VI_UNLOCK(vp);
 		mp->mnt_vfc->vfc_refcount--;
+		mtx_destroy(&mp->mnt_mtx);
 		vfs_unbusy(mp, td);
 #ifdef MAC
 		mac_destroy_mount(mp);

--=20
Pawel Jakub Dawidek                       pawel@dawidek.net
UNIX Systems Programmer/Administrator     http://garage.freebsd.pl
Am I Evil? Yes, I Am!                     http://cerber.sourceforge.net

--WeDu0lr7bteb/II5
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (FreeBSD)

iQCVAwUBP7idjj/PhmMH/Mf1AQHrtwQAlb7IdyP/Wium3g4F/PB0icGd3cMaJ+TG
gSX6NZqtk4vhgar7I4AZfhNGt/e4o2kSyjnBonoF0dfRo2EQjcUOCOhjX5CsW80m
uBAfF196bh3oazT/qjstHtfOr/ipPwJ1f19H0KB95lLgFroBL6gujx5dSRnRRrRz
3ASpG8ON0hM=
=JAAE
-----END PGP SIGNATURE-----

--WeDu0lr7bteb/II5--