From owner-svn-src-all@FreeBSD.ORG Sun Mar 27 19:56:55 2011 Return-Path: Delivered-To: svn-src-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 9B481106566B; Sun, 27 Mar 2011 19:56:55 +0000 (UTC) (envelope-from trociny@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c]) by mx1.freebsd.org (Postfix) with ESMTP id 6FD758FC18; Sun, 27 Mar 2011 19:56:55 +0000 (UTC) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.3/8.14.3) with ESMTP id p2RJutoR067493; Sun, 27 Mar 2011 19:56:55 GMT (envelope-from trociny@svn.freebsd.org) Received: (from trociny@localhost) by svn.freebsd.org (8.14.3/8.14.3/Submit) id p2RJutha067490; Sun, 27 Mar 2011 19:56:55 GMT (envelope-from trociny@svn.freebsd.org) Message-Id: <201103271956.p2RJutha067490@svn.freebsd.org> From: Mikolaj Golub Date: Sun, 27 Mar 2011 19:56:55 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: Subject: svn commit: r220062 - head/sys/geom/gate X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 27 Mar 2011 19:56:55 -0000 Author: trociny Date: Sun Mar 27 19:56:55 2011 New Revision: 220062 URL: http://svn.freebsd.org/changeset/base/220062 Log: In g_gate_create() there is a window between when g_gate_softc is registered in g_gate_units array and when its sc_provider field is filled. If during this period g_gate_units is accessed by another thread that is checking for provider name collision the crash is possible. Fix this by adding sc_name field to struct g_gate_softc. In g_gate_create() when g_gate_softc is created but sc_provider is still not sc_name points to provider name stored in the local array. Approved by: pjd (mentor) Reported by: Freddie Cash MFC after: 1 week Modified: head/sys/geom/gate/g_gate.c head/sys/geom/gate/g_gate.h Modified: head/sys/geom/gate/g_gate.c ============================================================================== --- head/sys/geom/gate/g_gate.c Sun Mar 27 19:29:18 2011 (r220061) +++ head/sys/geom/gate/g_gate.c Sun Mar 27 19:56:55 2011 (r220062) @@ -409,13 +409,14 @@ g_gate_create(struct g_gate_ctl_create * for (unit = 0; unit < g_gate_maxunits; unit++) { if (g_gate_units[unit] == NULL) continue; - if (strcmp(name, g_gate_units[unit]->sc_provider->name) != 0) + if (strcmp(name, g_gate_units[unit]->sc_name) != 0) continue; mtx_unlock(&g_gate_units_lock); mtx_destroy(&sc->sc_queue_mtx); free(sc, M_GATE); return (EEXIST); } + sc->sc_name = name; g_gate_units[sc->sc_unit] = sc; g_gate_nunits++; mtx_unlock(&g_gate_units_lock); @@ -434,6 +435,9 @@ g_gate_create(struct g_gate_ctl_create * sc->sc_provider = pp; g_error_provider(pp, 0); g_topology_unlock(); + mtx_lock(&g_gate_units_lock); + sc->sc_name = sc->sc_provider->name; + mtx_unlock(&g_gate_units_lock); if (sc->sc_timeout > 0) { callout_reset(&sc->sc_callout, sc->sc_timeout * hz, Modified: head/sys/geom/gate/g_gate.h ============================================================================== --- head/sys/geom/gate/g_gate.h Sun Mar 27 19:29:18 2011 (r220061) +++ head/sys/geom/gate/g_gate.h Sun Mar 27 19:56:55 2011 (r220062) @@ -76,6 +76,7 @@ * 'P:' means 'Protected by'. */ struct g_gate_softc { + char *sc_name; /* P: (read-only) */ int sc_unit; /* P: (read-only) */ int sc_ref; /* P: g_gate_list_mtx */ struct g_provider *sc_provider; /* P: (read-only) */ @@ -96,7 +97,6 @@ struct g_gate_softc { LIST_ENTRY(g_gate_softc) sc_next; /* P: g_gate_list_mtx */ char sc_info[G_GATE_INFOSIZE]; /* P: (read-only) */ }; -#define sc_name sc_provider->geom->name #define G_GATE_DEBUG(lvl, ...) do { \ if (g_gate_debug >= (lvl)) { \