Fixed breakage of mknod() in rev.1.48 of ext2_vnops.c and rev.1.126 of
ufs_vnops.c: 1) i_ino was confused with i_number, so the inode number passed to VFS_VGET() was usually wrong (usually 0U). 2) ip was dereferenced after vgone() freed it, so the inode number passed to VFS_VGET() was sometimes not even wrong. Bug (1) was usually fatal in ext2_mknod(), since ext2fs doesn't have space for inode 0 on the disk; ino_to_fsba() subtracts 1 from the inode number, so inode number 0U gives a way out of bounds array index. Bug(1) was usually harmless in ufs_mknod(); ino_to_fsba() doesn't subtract 1, and VFS_VGET() reads suitable garbage (all 0's?) from the disk for the invalid inode number 0U; ufs_mknod() returns a wrong vnode, but most callers just vput() it; the correct vnode is eventually obtained by an implicit VFS_VGET() just like it used to be. Bug (2) usually doesn't happen.
This commit is contained in:
parent
af6f98bd10
commit
1c1752872f
@ -264,6 +264,7 @@ ext2_mknod(ap)
|
||||
struct vattr *vap = ap->a_vap;
|
||||
struct vnode **vpp = ap->a_vpp;
|
||||
struct inode *ip;
|
||||
ino_t ino;
|
||||
int error;
|
||||
|
||||
error = ext2_makeinode(MAKEIMODE(vap->va_type, vap->va_mode),
|
||||
@ -286,8 +287,9 @@ ext2_mknod(ap)
|
||||
*/
|
||||
vput(*vpp);
|
||||
(*vpp)->v_type = VNON;
|
||||
ino = ip->i_number; /* Save this before vgone() invalidates ip. */
|
||||
vgone(*vpp);
|
||||
error = VFS_VGET(ap->a_dvp->v_mount, ip->i_ino, vpp);
|
||||
error = VFS_VGET(ap->a_dvp->v_mount, ino, vpp);
|
||||
if (error) {
|
||||
*vpp = NULL;
|
||||
return (error);
|
||||
|
@ -264,6 +264,7 @@ ext2_mknod(ap)
|
||||
struct vattr *vap = ap->a_vap;
|
||||
struct vnode **vpp = ap->a_vpp;
|
||||
struct inode *ip;
|
||||
ino_t ino;
|
||||
int error;
|
||||
|
||||
error = ext2_makeinode(MAKEIMODE(vap->va_type, vap->va_mode),
|
||||
@ -286,8 +287,9 @@ ext2_mknod(ap)
|
||||
*/
|
||||
vput(*vpp);
|
||||
(*vpp)->v_type = VNON;
|
||||
ino = ip->i_number; /* Save this before vgone() invalidates ip. */
|
||||
vgone(*vpp);
|
||||
error = VFS_VGET(ap->a_dvp->v_mount, ip->i_ino, vpp);
|
||||
error = VFS_VGET(ap->a_dvp->v_mount, ino, vpp);
|
||||
if (error) {
|
||||
*vpp = NULL;
|
||||
return (error);
|
||||
|
@ -208,6 +208,7 @@ ufs_mknod(ap)
|
||||
struct vattr *vap = ap->a_vap;
|
||||
struct vnode **vpp = ap->a_vpp;
|
||||
struct inode *ip;
|
||||
ino_t ino;
|
||||
int error;
|
||||
|
||||
error = ufs_makeinode(MAKEIMODE(vap->va_type, vap->va_mode),
|
||||
@ -231,8 +232,9 @@ ufs_mknod(ap)
|
||||
*/
|
||||
vput(*vpp);
|
||||
(*vpp)->v_type = VNON;
|
||||
ino = ip->i_number; /* Save this before vgone() invalidates ip. */
|
||||
vgone(*vpp);
|
||||
error = VFS_VGET(ap->a_dvp->v_mount, ip->i_ino, vpp);
|
||||
error = VFS_VGET(ap->a_dvp->v_mount, ino, vpp);
|
||||
if (error) {
|
||||
*vpp = NULL;
|
||||
return (error);
|
||||
|
Loading…
Reference in New Issue
Block a user