From d53d924f60b476dc34b419763a99bce1394780e2 Mon Sep 17 00:00:00 2001 From: Mateusz Guzik Date: Thu, 30 Jan 2020 19:38:12 +0000 Subject: [PATCH] vfs: keep the mount point referenced across sys_quotactl Otherwise we risk running into use-after-free. In particular this codepath ends up dropping all protection before suspending writes: ufs_quotactl -> quotaoff_inchange -> vfs_write_suspend_umnt Reported by: pho --- sys/kern/vfs_syscalls.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/sys/kern/vfs_syscalls.c b/sys/kern/vfs_syscalls.c index a3b66f0bcf47..3f87c71817af 100644 --- a/sys/kern/vfs_syscalls.c +++ b/sys/kern/vfs_syscalls.c @@ -189,9 +189,10 @@ sys_quotactl(struct thread *td, struct quotactl_args *uap) vfs_ref(mp); vput(nd.ni_vp); error = vfs_busy(mp, 0); - vfs_rel(mp); - if (error != 0) + if (error != 0) { + vfs_rel(mp); return (error); + } error = VFS_QUOTACTL(mp, uap->cmd, uap->uid, uap->arg); /* @@ -208,6 +209,7 @@ sys_quotactl(struct thread *td, struct quotactl_args *uap) if ((uap->cmd >> SUBCMDSHIFT) != Q_QUOTAON && (uap->cmd >> SUBCMDSHIFT) != Q_QUOTAOFF) vfs_unbusy(mp); + vfs_rel(mp); return (error); }