[Midnightbsd-cvs] src [9067] trunk/sys/kern/vfs_aio.c: fix a race.

[laffer1 at midnightbsd.org]

Revision: 9067
          http://svnweb.midnightbsd.org/src/?rev=9067
Author:   laffer1
Date:     2016-10-01 06:13:25 -0400 (Sat, 01 Oct 2016)
Log Message:
-----------
fix a race.

Modified Paths:
--------------
    trunk/sys/kern/vfs_aio.c

Modified: trunk/sys/kern/vfs_aio.c
===================================================================
--- trunk/sys/kern/vfs_aio.c	2016-10-01 10:13:08 UTC (rev 9066)
+++ trunk/sys/kern/vfs_aio.c	2016-10-01 10:13:25 UTC (rev 9067)
@@ -1254,9 +1254,11 @@
 	struct file *fp;
 	struct buf *bp;
 	struct vnode *vp;
+	struct cdevsw *csw;
+	struct cdev *dev;
 	struct kaioinfo *ki;
 	struct aioliojob *lj;
-	int error;
+	int error, ref;
 
 	cb = &aiocbe->uaiocb;
 	fp = aiocbe->fd_file;
@@ -1284,9 +1286,6 @@
  	if (cb->aio_nbytes % vp->v_bufobj.bo_bsize)
 		return (-1);
 
-	if (cb->aio_nbytes > vp->v_rdev->si_iosize_max)
-		return (-1);
-
 	if (cb->aio_nbytes >
 	    MAXPHYS - (((vm_offset_t) cb->aio_buf) & PAGE_MASK))
 		return (-1);
@@ -1295,6 +1294,15 @@
 	if (ki->kaio_buffer_count >= ki->kaio_ballowed_count)
 		return (-1);
 
+	ref = 0;
+	csw = devvn_refthread(vp, &dev, &ref);
+	if (csw == NULL)
+		return (ENXIO);
+	if (cb->aio_nbytes > dev->si_iosize_max) {
+		error = -1;
+		goto unref;
+	}
+
 	/* Create and build a buffer header for a transfer. */
 	bp = (struct buf *)getpbuf(NULL);
 	BUF_KERNPROC(bp);
@@ -1347,7 +1355,8 @@
 	TASK_INIT(&aiocbe->biotask, 0, biohelper, aiocbe);
 
 	/* Perform transfer. */
-	dev_strategy(vp->v_rdev, bp);
+	dev_strategy_csw(dev, csw, bp);
+	dev_relthread(dev, ref);
 	return (0);
 
 doerror:
@@ -1359,6 +1368,8 @@
 	aiocbe->bp = NULL;
 	AIO_UNLOCK(ki);
 	relpbuf(bp, NULL);
+unref:
+	dev_relthread(dev, ref);
 	return (error);
 }