As found by tb@ and visa@, `f_mtx' need to block interrupts as long as
it can be taken w/ and w/o the KERNEL_LOCK().  Otherwise a deadlock is
possible if an interrupt tries to grab the KERNEL_LOCK().

I'm not switching to a rwlock because code paths are short, I don't
want to introduce new sleeping points and in the long run we should
be using SRPs or atomic operations for reference counts.

ok?

Index: kern/kern_descrip.c
===================================================================
RCS file: /cvs/src/sys/kern/kern_descrip.c,v
retrieving revision 1.158
diff -u -p -r1.158 kern_descrip.c
--- kern/kern_descrip.c 8 May 2018 09:03:58 -0000       1.158
+++ kern/kern_descrip.c 28 May 2018 09:23:31 -0000
@@ -957,7 +957,11 @@ restart:
         */
        numfiles++;
        fp = pool_get(&file_pool, PR_WAITOK|PR_ZERO);
-       mtx_init(&fp->f_mtx, IPL_NONE);
+       /*
+        * We need to block interrupts as long as `f_mtx' is being taken
+        * with and without the KERNEL_LOCK().
+        */
+       mtx_init(&fp->f_mtx, IPL_VM);
        fp->f_iflags = FIF_LARVAL;
        if ((fq = p->p_fd->fd_ofiles[0]) != NULL) {
                LIST_INSERT_AFTER(fq, fp, f_list);

Reply via email to