freebsd-dev/sys/ufs/ffs
Konstantin Belousov 9604a7f1b8 Fix several unsafe pointer dereferences in the buffered_write()
function, implementing the sysctl vfs.ffs.set_bufoutput (not used in
the tree yet).

- The current directory vnode dereference is unsafe since fd_cdir
  could be changed and unreferenced, lock the filedesc around and vref
  the fd_cdir.
- The VTOI() conversion of the fd_cdir is unsafe without first
  checking that the vnode is indeed from an FFS mount, otherwise
  the code dereferences a random memory.
- The cdir could be reclaimed from under us, lock it around the
  checks.
- The type of the fp vnode might be not a disk, or it might have
  changed while the thread was in flight, check the type.

Reviewed and tested by:	mckusick
MFC after:	2 weeks
2013-02-10 10:17:33 +00:00
..
ffs_alloc.c Fix several unsafe pointer dereferences in the buffered_write() 2013-02-10 10:17:33 +00:00
ffs_balloc.c When a file is first being written, the dynamic block reallocation 2012-11-03 18:55:55 +00:00
ffs_extern.h Add UFS writesuspension mechanism, designed to allow userland processes 2012-11-18 18:57:19 +00:00
ffs_inode.c For UFS2 i_blocks is unsigned. The current "sanity" check that it 2013-02-03 17:16:32 +00:00
ffs_rawread.c Add a third flags argument to ffs_syncvnode to avoid a possible conflict 2012-03-25 00:02:37 +00:00
ffs_snapshot.c Add flags argument to vfs_write_resume() and remove 2013-01-11 06:08:32 +00:00
ffs_softdep.c Add flags argument to vfs_write_resume() and remove 2013-01-11 06:08:32 +00:00
ffs_subr.c - Merge soft-updates journaling from projects/suj/head into head. This 2010-04-24 07:05:35 +00:00
ffs_suspend.c Add flags argument to vfs_write_resume() and remove 2013-01-11 06:08:32 +00:00
ffs_tables.c
ffs_vfsops.c Add flags argument to vfs_write_resume() and remove 2013-01-11 06:08:32 +00:00
ffs_vnops.c After the PHYS_TO_VM_PAGE() function was de-inlined, the main reason 2012-08-05 14:11:42 +00:00
fs.h Fix build of kdump(1). 2012-11-18 22:03:31 +00:00
softdep.h - Speed up pendingblock processing again. Having too much delay between 2011-07-04 22:08:04 +00:00