[src/trunk]: src/sys/kern Dounmount() violates the locking protocol for membe...

[hannken <hannken%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/3374c7077b5b
branches:  trunk
changeset: 789656:3374c7077b5b
user:      hannken <hannken%NetBSD.org@localhost>
date:      Fri Aug 30 12:58:22 2013 +0000

description:
Dounmount() violates the locking protocol for member v_mountedhere.
A vnode lock is required to access or modify this field.

Lock/unlock the vnode when clearing v_mountedhere.

Reviewed by: David Holland <dholland%netbsd.org@localhost>

Should fix PR #48135 (Bad locking for umount)

diffstat:

 sys/kern/vfs_mount.c |  11 +++++++----
 1 files changed, 7 insertions(+), 4 deletions(-)

diffs (33 lines):

diff -r da2e99859f79 -r 3374c7077b5b sys/kern/vfs_mount.c
--- a/sys/kern/vfs_mount.c      Fri Aug 30 11:10:34 2013 +0000
+++ b/sys/kern/vfs_mount.c      Fri Aug 30 12:58:22 2013 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: vfs_mount.c,v 1.19 2013/04/28 21:34:31 mlelstv Exp $   */
+/*     $NetBSD: vfs_mount.c,v 1.20 2013/08/30 12:58:22 hannken Exp $   */
 
 /*-
  * Copyright (c) 1997-2011 The NetBSD Foundation, Inc.
@@ -67,7 +67,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: vfs_mount.c,v 1.19 2013/04/28 21:34:31 mlelstv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: vfs_mount.c,v 1.20 2013/08/30 12:58:22 hannken Exp $");
 
 #include <sys/param.h>
 #include <sys/kernel.h>
@@ -878,9 +878,12 @@
        mp->mnt_iflag |= IMNT_GONE;
        mutex_exit(&mp->mnt_unmounting);
 
+       if ((coveredvp = mp->mnt_vnodecovered) != NULLVP) {
+               vn_lock(coveredvp, LK_EXCLUSIVE | LK_RETRY);
+               coveredvp->v_mountedhere = NULL;
+               VOP_UNLOCK(coveredvp);
+       }
        mutex_enter(&mountlist_lock);
-       if ((coveredvp = mp->mnt_vnodecovered) != NULLVP)
-               coveredvp->v_mountedhere = NULL;
        CIRCLEQ_REMOVE(&mountlist, mp, mnt_list);
        mutex_exit(&mountlist_lock);
        if (TAILQ_FIRST(&mp->mnt_vnodelist) != NULL)