OS-2750 kstat_install()/header_kstat_snapshot() race induces panic [add comment]20140206release-20140206

1 files changed, 6 insertions, 0 deletions

diff --git a/usr/src/uts/common/os/kstat_fr.c b/usr/src/uts/common/os/kstat_fr.c
index a9f2e8eede..9b9634028c 100644
--- a/usr/src/uts/common/os/kstat_fr.c
+++ b/usr/src/uts/common/os/kstat_fr.c
@@ -1207,6 +1207,12 @@ kstat_install(kstat_t *ksp)
 
 	/*
 	 * Now that the kstat is active, make it visible to the kstat driver.
+	 * When copying out kstats the count is determined in
+	 * header_kstat_update() and actually copied into kbuf in
+	 * header_kstat_snapshot(). kstat_chain_lock is held across the two
+	 * calls to ensure that this list doesn't change. Thus, we need to
+	 * also take the lock to ensure that the we don't copy the new kstat
+	 * in the 2nd pass and overrun the buf.
 	 */
 	mutex_enter(&kstat_chain_lock);
 	ksp->ks_flags &= ~KSTAT_FLAG_INVALID;