DragonFlyBSD Kernel Audit
DF-0762 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/vfs/hammer2/hammer2_chain.c b/sys/vfs/hammer2/hammer2_chain.c
--- a/sys/vfs/hammer2/hammer2_chain.c
+++ b/sys/vfs/hammer2/hammer2_chain.c
@@ -645,13 +645,14 @@
 		/* FALL THROUGH */
 	} else {
 		/*
-		 * No-parent case.
+		 * No-parent case.  parent is NULL here, so the parent
+		 * core spinlock is NOT held and must not be released.
+		 * Only the chain core spinlock (held) and chain mutex are.
 		 */
 		if (atomic_cmpset_int(&chain->refs, 1, 0) == 0) {
 			/*
 			 * 1->0 transition failed, retry.
 			 */
-			hammer2_spin_unex(&parent->core.spin);
 			hammer2_spin_unex(&chain->core.spin);
 			hammer2_mtx_unlock(&chain->lock);