DragonFlyBSD Kernel Audit
DF-0047 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/kern/kern_mutex.c b/sys/kern/kern_mutex.c
--- a/sys/kern/kern_mutex.c
+++ b/sys/kern/kern_mutex.c
@@ -1010,6 +1010,18 @@
 	case MTX_LINK_LINKED_EX:
 	case MTX_LINK_LINKED_SH:
 		mtx_delete_link(mtx, link);
+		/*
+		 * DF-0047: a concurrent mtx_chain_link_ex/sh() can grant
+		 * the lock to us during the mtx_delete_link() LINKSPIN
+		 * acquire window -- it sets link->state = MTX_LINK_ACQUIRED
+		 * and mtx->mtx_owner = curthread.  If that happened we now
+		 * own the mutex exclusively, so the caller must release it:
+		 * return success instead of leaking the lock.
+		 */
+		if (link->state == MTX_LINK_ACQUIRED) {
+			error = 0;
+			break;
+		}
 		/* fall through */
 	default:
 		if (error == 0)