It's too easy to panic the machine when INVARIANTS are turned on
and you botch a call to nmount(2). This is because there is an INVARIANTS check that asserts that opt->len must be zero if opt->val is not NULL. The problem is that the code does not actually follow this invariant if there is an error while processing mount options. Fix the code to honor the INVARIANT. Silence on: fs@
This commit is contained in:
parent
4adf97c04d
commit
a91f587457
@ -274,7 +274,7 @@ vfs_buildopts(struct uio *auio, struct vfsoptlist **options)
|
||||
optlen = auio->uio_iov[i + 1].iov_len;
|
||||
opt->name = malloc(namelen, M_MOUNT, M_WAITOK);
|
||||
opt->value = NULL;
|
||||
opt->len = optlen;
|
||||
opt->len = 0;
|
||||
|
||||
/*
|
||||
* Do this early, so jumps to "bad" will free the current
|
||||
@ -308,6 +308,7 @@ vfs_buildopts(struct uio *auio, struct vfsoptlist **options)
|
||||
goto bad;
|
||||
}
|
||||
if (optlen != 0) {
|
||||
opt->len = optlen;
|
||||
opt->value = malloc(optlen, M_MOUNT, M_WAITOK);
|
||||
if (auio->uio_segflg == UIO_SYSSPACE) {
|
||||
bcopy(auio->uio_iov[i + 1].iov_base, opt->value,
|
||||
|
Loading…
Reference in New Issue
Block a user