⬢ DragonFlyBSD Kernel Audit
DF-2914 / fix.diff
← back to finding ↓ download raw
--- a/sys/kern/kern_conf.c	2026-06-29 12:51:19.000000000 +0000
+++ b/sys/kern/kern_conf.c	2026-10-26 00:25:42.777043079 +0000
@@ -126,7 +126,7 @@
 int
 dev_is_good(cdev_t dev)
 {
-	if (dev != NULL && dev->si_ops != &dead_dev_ops)
+	if (dev != NULL && (dev->si_flags & SI_DESTROYED) == 0)
 		return(1);
 	return(0);
 }
--- a/sys/sys/conf.h	2026-06-29 12:51:19.000000000 +0000
+++ b/sys/sys/conf.h	2026-10-26 00:25:42.777043079 +0000
@@ -103,7 +103,7 @@
 	struct kqinfo	si_kqinfo;	/* degenerate delegated knotes */
 };
 
-#define SI_UNUSED01	0x0001
+#define SI_DESTROYED	0x0001	/* destroy_dev_worker ran on this cdev */
 #define SI_HASHED	0x0002	/* in (maj,min) hash table */
 #define SI_OVERRIDE	0x0004	/* override uid, gid, and perms */
 #define SI_INTERCEPTED	0x0008	/* device ops was intercepted */
--- a/sys/vfs/devfs/devfs_core.c	2026-06-29 12:51:19.000000000 +0000
+++ b/sys/vfs/devfs/devfs_core.c	2026-10-26 00:25:42.777043079 +0000
@@ -1444,6 +1444,9 @@
 	KKASSERT(dev);
 	KKASSERT((lockstatus(&devfs_lock, curthread)) == LK_EXCLUSIVE);
 
+	/* mark the cdev destroyed so dev_is_good() fences take effect */
+	dev->si_flags |= SI_DESTROYED;
+
 	error = devfs_unlink_dev(dev);
 	devfs_propagate_dev(dev, 0);