d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

In fhopen, vfs_ref() the mount point while vnode is unlocked, to prevent

Browse Source 
vn_start_write(NULL, &mp) from operating on potentially freed or reused
struct mount *.

Remove unmatched vfs_rel() in cleanup.

Noted and reviewed by:	tegge
Tested by:	pho
MFC after:	3 days
This commit is contained in:
Konstantin Belousov 2009-09-06 11:44:46 +00:00
parent 4d3b1aacfc
commit db17314ea4
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
sys/kern/vfs_syscalls.c
View File

@ -4439,12 +4439,15 @@ fhopen(td, uap)
goto bad;
}
if (fmode & O_TRUNC) {
vfs_ref(mp);
VOP_UNLOCK(vp, 0); /* XXX */
if ((error = vn_start_write(NULL, &mp, V_WAIT | PCATCH)) != 0) {
vrele(vp);
vfs_rel(mp);
goto out;
}
vn_lock(vp, LK_EXCLUSIVE | LK_RETRY); /* XXX */
vfs_rel(mp);
#ifdef MAC
/*
* We don't yet have fp->f_cred, so use td->td_ucred, which
@ -4516,7 +4519,6 @@ fhopen(td, uap)
VOP_UNLOCK(vp, 0);
fdrop(fp, td);
vfs_rel(mp);
VFS_UNLOCK_GIANT(vfslocked);
td->td_retval[0] = indx;
return (0);