⬢ DragonFlyBSD Kernel Audit
DF-2533 / fix.diff
← back to finding ↓ download raw
--- a/sys/dev/disk/xdisk/xdisk.c	2026-10-19 20:05:30.113085120 +0000
+++ b/sys/dev/disk/xdisk/xdisk.c	2026-10-19 20:05:30.133084863 +0000
@@ -766,10 +766,17 @@
 
 	lockmgr(&xdisk_lk, LK_EXCLUSIVE);
 	sc = dev->si_drv1;
-	if (sc == NULL)
+	if (sc == NULL) {
+		lockmgr(&xdisk_lk, LK_RELEASE);
 		return ENXIO;	/* raced destruction */
+	}
 	if (sc->terminating) {
-		lockmgr(&sc->lk, LK_RELEASE);
+		/*
+		 * sc->lk was never acquired here; releasing a lock nobody
+		 * holds panics in lockmgr_release().  Release the lock we
+		 * actually hold, mirroring xa_open() above.
+		 */
+		lockmgr(&xdisk_lk, LK_RELEASE);
 		return ENXIO;	/* raced destruction */
 	}
 	lockmgr(&sc->lk, LK_EXCLUSIVE);