⬢ DragonFlyBSD Kernel Audit
DF-3171 / fix.diff
← back to finding ↓ download raw
diff --git a/a/sys/vfs/mfs/mfs_vfsops.c b/b/sys/vfs/mfs/mfs_vfsops.c
index cab8c18..42ba77c 100644
--- a/sys/vfs/mfs/mfs_vfsops.c
+++ b/b/sys/vfs/mfs/mfs_vfsops.c
@@ -141,6 +141,20 @@ mfsclose(struct dev_close_args *ap)
 
 	if ((mfsp = dev->si_drv1) == NULL)
 		return(0);
+	/*
+	 * Only the final close of a device whose filesystem has been
+	 * unmounted may take the I/O server down.  devfs calls d_close
+	 * on vnode reclaim (VRECLAIMED) even when other references
+	 * (including the mount itself) still hold the device open;
+	 * killing the server then leaves a mounted filesystem with a
+	 * destroyed device and a freed mfsnode.
+	 *
+	 * ffs_unmount() clears dev->si_mountpoint before its VOP_CLOSE(),
+	 * so si_mountpoint != NULL means the filesystem is still mounted
+	 * and this close must be ignored.
+	 */
+	if (dev->si_mountpoint != NULL)
+		return(0);
         mfsp->mfs_active = 0;
         wakeup((caddr_t)mfsp);
 	return(0);