From cbcde3ba8058d84d86d3a36b1ebbec37ed1f35ea Mon Sep 17 00:00:00 2001
From: Ingo Weinhold <ingo_weinhold@gmx.de>
Date: Tue, 2 Jul 2013 01:16:02 +0200
Subject: [PATCH] kernel team.cpp: fix unbalanced io_context ref management

... in case of team creation error. Once assigned to Team::io_context
the Team object takes responsibility of the I/O context object and
releases the reference on destruction. load_image_internal() and
fork_team() were thus releasing one reference too many.

Fixes #9851.
---
 src/system/kernel/team.cpp | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/src/system/kernel/team.cpp b/src/system/kernel/team.cpp
index 1212b62df5..abd52ed3c5 100644
--- a/src/system/kernel/team.cpp
+++ b/src/system/kernel/team.cpp
@@ -503,7 +503,8 @@ Team::~Team()
 	// get rid of all associated data
 	PrepareForDeletion();
 
-	vfs_put_io_context(io_context);
+	if (io_context != NULL)
+		vfs_put_io_context(io_context);
 	delete_owned_ports(this);
 	sem_delete_owned_sems(this);
 
@@ -1752,7 +1753,7 @@ load_image_internal(char**& _flatArgs, size_t flatArgsSize, int32 argCount,
 	status = VMAddressSpace::Create(team->id, USER_BASE, USER_SIZE, false,
 		&team->address_space);
 	if (status != B_OK)
-		goto err3;
+		goto err2;
 
 	// create the user data area
 	status = create_team_user_data(team);
@@ -1814,8 +1815,6 @@ err5:
 	delete_team_user_data(team);
 err4:
 	team->address_space->Put();
-err3:
-	vfs_put_io_context(team->io_context);
 err2:
 	free_team_arg(teamArgs);
 err1:
@@ -2075,7 +2074,7 @@ fork_team(void)
 			parentTeam->realtime_sem_context);
 		if (team->realtime_sem_context == NULL) {
 			status = B_NO_MEMORY;
-			goto err25;
+			goto err2;
 		}
 	}
 
@@ -2170,8 +2169,6 @@ err4:
 	team->address_space->RemoveAndPut();
 err3:
 	delete_realtime_sem_context(team->realtime_sem_context);
-err25:
-	vfs_put_io_context(team->io_context);
 err2:
 	free(forkArgs);
 err1: