DragonFlyBSD Kernel Audit
DF-0958 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/vm/device_pager.c b/sys/vm/device_pager.c
--- a/sys/vm/device_pager.c
+++ b/sys/vm/device_pager.c
@@ -156,8 +156,11 @@
 		/*
 		 * Gain a reference to the object.
 		 */
+		/*
+		 * DF-0958: vm_pager_object_lookup() already acquired our
+		 * reference; do not take a second one or the object will leak.
+		 */
 		vm_object_hold(object);
-		vm_object_reference_locked(object);
 		if (OFF_TO_IDX(foff + size) > object->size)
 			object->size = OFF_TO_IDX(foff + size);
 		vm_object_drop(object);