DF-2680 / fix.diff
--- a/sys/kern/subr_bus.c +++ b/sys/kern/subr_bus.c @@ -352,10 +352,14 @@ devopen(struct dev_close_args *ap) static int devclose(struct dev_close_args *ap) { lockmgr(&devsoftc.lock, LK_EXCLUSIVE); devsoftc.inuse = 0; + /* + * DF-2680: async_proc is a raw curproc pointer captured by + * FIOASYNC with no reference; it must not outlive the owner. + */ + devsoftc.async_proc = NULL; wakeup(&devsoftc); lockmgr(&devsoftc.lock, LK_RELEASE); return (0); } |