⬢ DragonFlyBSD Kernel Audit
DF-5729 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
diff --git a/sys/kern/lwkt_token.c b/sys/kern/lwkt_token.c
--- a/sys/kern/lwkt_token.c
+++ b/sys/kern/lwkt_token.c
@@ -659,9 +659,9 @@
 
 	ref = td->td_toks_stop;
 	KKASSERT(ref < &td->td_toks_end);
-	++td->td_toks_stop;
-	cpu_ccfence();
 	_lwkt_tokref_init(ref, tok, td, TOK_EXCLUSIVE|TOK_EXCLREQ);
+	cpu_ccfence();
+	++td->td_toks_stop;
 
 #ifdef DEBUG_LOCKS
 	/*
@@ -730,9 +730,9 @@
 
 	ref = td->td_toks_stop;
 	KKASSERT(ref < &td->td_toks_end);
-	++td->td_toks_stop;
-	cpu_ccfence();
 	_lwkt_tokref_init(ref, tok, td, TOK_EXCLREQ);
+	cpu_ccfence();
+	++td->td_toks_stop;
 
 #ifdef DEBUG_LOCKS
 	/*
@@ -796,9 +796,9 @@
 
 	ref = td->td_toks_stop;
 	KKASSERT(ref < &td->td_toks_end);
-	++td->td_toks_stop;
-	cpu_ccfence();
 	_lwkt_tokref_init(ref, tok, td, TOK_EXCLUSIVE|TOK_EXCLREQ);
+	cpu_ccfence();
+	++td->td_toks_stop;
 
 	if (_lwkt_trytokref(ref, td, TOK_EXCLUSIVE))
 		return TRUE;
diff --git a/sys/ddb/db_ps.c b/sys/ddb/db_ps.c
--- a/sys/ddb/db_ps.c
+++ b/sys/ddb/db_ps.c
@@ -191,7 +191,8 @@
 		return;
 	db_printf("    TOKENS:");
 	for (ref = &td->td_toks_base; ref < td->td_toks_stop; ++ref) {
-		tok = ref->tr_tok;
+		if ((tok = ref->tr_tok) == NULL)
+			continue;	/* mid-acquire snapshot window */
 
 		db_printf(" %p[tok=%p", ref, ref->tr_tok);
 		if (tok->t_ref && td == tok->t_ref->tr_owner)