From owner-cvs-src@FreeBSD.ORG  Wed Mar 21 19:32:09 2007
Return-Path: <owner-cvs-src@FreeBSD.ORG>
X-Original-To: cvs-src@FreeBSD.org
Delivered-To: cvs-src@FreeBSD.org
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
	by hub.freebsd.org (Postfix) with ESMTP id ABCD716A417;
	Wed, 21 Mar 2007 19:32:09 +0000 (UTC) (envelope-from jhb@FreeBSD.org)
Received: from repoman.freebsd.org (repoman.freebsd.org [69.147.83.41])
	by mx1.freebsd.org (Postfix) with ESMTP id 9A5C613C4B9;
	Wed, 21 Mar 2007 19:32:09 +0000 (UTC) (envelope-from jhb@FreeBSD.org)
Received: from repoman.freebsd.org (localhost [127.0.0.1])
	by repoman.freebsd.org (8.13.8/8.13.8) with ESMTP id l2LJW8hx093197;
	Wed, 21 Mar 2007 19:32:08 GMT (envelope-from jhb@repoman.freebsd.org)
Received: (from jhb@localhost)
	by repoman.freebsd.org (8.13.8/8.13.8/Submit) id l2LJW8ht093196;
	Wed, 21 Mar 2007 19:32:08 GMT (envelope-from jhb)
Message-Id: <200703211932.l2LJW8ht093196@repoman.freebsd.org>
From: John Baldwin <jhb@FreeBSD.org>
Date: Wed, 21 Mar 2007 19:32:08 +0000 (UTC)
To: src-committers@FreeBSD.org, cvs-src@FreeBSD.org, cvs-all@FreeBSD.org
X-FreeBSD-CVS-Branch: HEAD
Cc: 
Subject: cvs commit: src/sys/kern vfs_syscalls.c
X-BeenThere: cvs-src@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: CVS commit messages for the src tree <cvs-src.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/cvs-src>,
	<mailto:cvs-src-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/cvs-src>
List-Post: <mailto:cvs-src@freebsd.org>
List-Help: <mailto:cvs-src-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/cvs-src>,
	<mailto:cvs-src-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 21 Mar 2007 19:32:09 -0000

jhb         2007-03-21 19:32:08 UTC

  FreeBSD src repository

  Modified files:
    sys/kern             vfs_syscalls.c 
  Log:
  If vn_open() fails during kern_open(), don't fdrop() the new file object
  until after the call to fdclose().  This closes an obscure race that
  could result in the later call to fdclose() actually closing a different
  file descriptor if another thread close()'s the file descriptor being
  opened before fdrop() is called, so the fdrop() in kern_open() frees the
  file object, then the second thread (or a third) creates a new file
  descriptor which reuses both the same index and the same file pointer
  thus tricking fdclose() in the first thread into thinking that the
  original file was still open.
  
  MFC after:      1 week
  
  Revision  Changes    Path
  1.434     +2 -5      src/sys/kern/vfs_syscalls.c