From owner-freebsd-current@FreeBSD.ORG  Tue Jun 17 03:44:49 2003
Return-Path: <owner-freebsd-current@FreeBSD.ORG>
Delivered-To: freebsd-current@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 61D1537B401
	for <current@FreeBSD.org>; Tue, 17 Jun 2003 03:44:49 -0700 (PDT)
Received: from gw.catspoiler.org (217-ip-163.nccn.net [209.79.217.163])
	by mx1.FreeBSD.org (Postfix) with ESMTP id C7A0843FAF
	for <current@FreeBSD.org>; Tue, 17 Jun 2003 03:44:48 -0700 (PDT)
	(envelope-from truckman@FreeBSD.org)
Received: from FreeBSD.org (mousie.catspoiler.org [192.168.101.2])
	by gw.catspoiler.org (8.12.9/8.12.9) with ESMTP id h5HAigM7051410
	for <current@FreeBSD.org>; Tue, 17 Jun 2003 03:44:46 -0700 (PDT)
	(envelope-from truckman@FreeBSD.org)
Message-Id: <200306171044.h5HAigM7051410@gw.catspoiler.org>
Date: Tue, 17 Jun 2003 03:44:42 -0700 (PDT)
From: Don Lewis <truckman@FreeBSD.org>
To: current@FreeBSD.org
MIME-Version: 1.0
Content-Type: TEXT/plain; charset=us-ascii
Subject: fdrop_locked() and FILE_LOCK() vs. Giant
X-BeenThere: freebsd-current@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Discussions about the use of FreeBSD-current
	<freebsd-current.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-current>
List-Post: <mailto:freebsd-current@freebsd.org>
List-Help: <mailto:freebsd-current-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 17 Jun 2003 10:44:49 -0000

The FILE_LOCK() implementation uses "pool mutex" under the hood, which
means it should only be used as a leaf level mutex.  The fdrop_locked()
code wants to be called with FILE_LOCK() held, but the fdrop_locked()
implementation calls mtx_lock(&Giant) before calling FILE_UNLOCK().  In
addition to violating the proper usage of the "pool mutex", there is
also the potential for a lock order violation.  The close()
implementation grabs Giant and eventually calls fdrop(), which calls
FILE_LOCK() immediately before calling fdrop_locked().  If another
caller of fdrop_locked() calls FILE_LOCK() without grabbing Giant first,
then the lock order will be reversed when fdrop_locked() grabs Giant.

It looks like fdrop_locked() should require that Giant be grabbed by the
caller before fdrop_locked() is called.