spl-mutex: fix race in mutex_exit

Prevent race on accessing kmutex_t when the mutex is embedded in a ref counted structure. Issue openzfs/zfs#6401 Signed-off-by: Gvozden Neskovic <[email protected]>
ofaaland · Aug 3, 2017 · a672710 · a672710
1 parent 1f2671b
commit a672710
Showing 1 changed file with 4 additions and 3 deletions.
diff --git a/include/sys/mutex.h b/include/sys/mutex.h
@@ -183,12 +183,13 @@ spl_mutex_lockdep_on_maybe(kmutex_t *mp)			\
  */
 #define	mutex_exit(mp)						\
 {								\
-	spl_mutex_lockdep_off_maybe(mp);			\
-	spin_lock(&(mp)->m_lock);				\
 	spl_mutex_clear_owner(mp);				\
+	spin_lock(&(mp)->m_lock);				\
+	spl_mutex_lockdep_off_maybe(mp);			\
 	mutex_unlock(MUTEX(mp));				\
-	spin_unlock(&(mp)->m_lock);				\
 	spl_mutex_lockdep_on_maybe(mp);				\
+	spin_unlock(&(mp)->m_lock);				\
+	/* NOTE: do not dereference mp after this point */	\
 }
 
 int spl_mutex_init(void);