Re: kern/48135: Bad locking for umount

["J. Hannken-Illjes" <hannken%eis.cs.tu-bs.de@localhost>]

The following reply was made to PR kern/48135; it has been noted by GNATS.

From: "J. Hannken-Illjes" <hannken%eis.cs.tu-bs.de@localhost>
To: gnats-bugs%NetBSD.org@localhost
Cc: 
Subject: Re: kern/48135: Bad locking for umount
Date: Thu, 22 Aug 2013 12:36:21 +0200

 On Aug 21, 2013, at 11:20 PM, Michael van Elst <mlelstv%serpens.de@localhost> =
 wrote:
 > On Wed, Aug 21, 2013 at 10:35:00AM +0000, J. Hannken-Illjes wrote:
 >>=20
 >> This fix looks wrong.
 >>=20
 >> If it is possible for the (last) reference to go away while =
 vfs_busy() is
 >> running it is also unsafe to increment the reference counter here as =
 it
 >> could be zero and be freed from vfs_destroy().
 >=20
 > It is supposed to be a precondition to vfs_busy() that the reference =
 count
 > is not zero, otherwise it couldn't use the mp pointer for anything.
 
 If this precondition "The caller must hold a pre-existing reference to =
 the mount"
 would be met this error could not happen as vfs_busy() will not =
 decrement
 the reference count.
 
 And if this precondition is not met even incrementing the reference
 count is prone to races as the reference count is part of the mount =
 struct.
 
 Btw.: I'm not able to reproduce this error here -- what exactly is
       your setup (amd configuration etc.)
 
 --
 J. Hannken-Illjes - hannken%eis.cs.tu-bs.de@localhost - TU Braunschweig 
(Germany)