]> CyberLeo.Net >> Repos - FreeBSD/FreeBSD.git/commit
Right now, dounmount() is called with unreferenced mount point.
authorkib <kib@FreeBSD.org>
Wed, 27 May 2015 09:22:50 +0000 (09:22 +0000)
committerkib <kib@FreeBSD.org>
Wed, 27 May 2015 09:22:50 +0000 (09:22 +0000)
commitd77dbf3761f318998d4f01063cea23ad73dc7bdf
tree94255445469c1443152fced77eb57ef614568b66
parent260b7bb2591a59fccbee5832cc083c39d7cf2bba
Right now, dounmount() is called with unreferenced mount point.
Nothing stops a parallel unmount to suceed before the given call to
dounmount() checks and locks the covered vnode.  Prevent dounmount()
from acting on the freed (although type-stable) memory by changing the
interface to require the mount point to be referenced.  dounmount()
consumes the reference on return, regardless of the sucessfull or
erronous result.

Tested by: pho
Sponsored by: The FreeBSD Foundation
MFC after: 2 weeks
sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_ctldir.c
sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_ioctl.c
sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_vfsops.c
sys/kern/vfs_mount.c
sys/kern/vfs_subr.c