Fix the race of dereferencing /proc/<pid>/file with execve(2) by caching
the value of p_textvp. This way, we always unlock the locked vnode. While there, vhold() the vnode around the vn_lock(). Reported and tested by: Guy Helmer (ghelmer palisadesys com) Approved by: des (procfs maintainer) MFC after: 1 week
This commit is contained in:
parent
e9f995d824
commit
a257337698
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=166548
@ -69,10 +69,18 @@ procfs_doprocfile(PFS_FILL_ARGS)
|
||||
{
|
||||
char *fullpath = "unknown";
|
||||
char *freepath = NULL;
|
||||
struct vnode *textvp;
|
||||
int err;
|
||||
|
||||
vn_lock(p->p_textvp, LK_EXCLUSIVE | LK_RETRY, td);
|
||||
vn_fullpath(td, p->p_textvp, &fullpath, &freepath);
|
||||
VOP_UNLOCK(p->p_textvp, 0, td);
|
||||
textvp = p->p_textvp;
|
||||
VI_LOCK(textvp);
|
||||
vholdl(textvp);
|
||||
err = vn_lock(textvp, LK_EXCLUSIVE | LK_INTERLOCK, td);
|
||||
vdrop(textvp);
|
||||
if (err)
|
||||
return (err);
|
||||
vn_fullpath(td, textvp, &fullpath, &freepath);
|
||||
VOP_UNLOCK(textvp, 0, td);
|
||||
sbuf_printf(sb, "%s", fullpath);
|
||||
if (freepath)
|
||||
free(freepath, M_TEMP);
|
||||
|
Loading…
Reference in New Issue
Block a user