diff options
author | rmacklem <rmacklem@FreeBSD.org> | 2015-12-02 21:48:34 +0000 |
---|---|---|
committer | rmacklem <rmacklem@FreeBSD.org> | 2015-12-02 21:48:34 +0000 |
commit | 68e44b1d7045a500ada4760ebd096f99e1544d2e (patch) | |
tree | 86bc954999cbb61df412a1e4c59dd1eff688796e | |
parent | ccce6feaa419fbc5fc1c0f617f6ad974b07a58c4 (diff) | |
download | FreeBSD-src-68e44b1d7045a500ada4760ebd096f99e1544d2e.zip FreeBSD-src-68e44b1d7045a500ada4760ebd096f99e1544d2e.tar.gz |
MFC: r291035
The problem report was for a crash that happened when smbfs was
trying to do a mount. Given the backtrace,
it appears that the crash occurred when smb_vc_create() failed and then
called smb_vc_put() with vcp->vc_iod == NULL. smb_vc_put() subsequently
called smb_vc_disconnect() with vcp->vc_iod == NULL, causing the crash.
This patch adds a check for vcp->vc_iod != NULL in smb_vc_disconnect() to
avoid the crash. It also fixes the case in smb_vc_create() where
kproc_create() fails so that it destroys the mutexes and sets
vcp->vc_iod == NULL before free()'ing the iod structure.
-rw-r--r-- | sys/netsmb/smb_conn.c | 4 | ||||
-rw-r--r-- | sys/netsmb/smb_iod.c | 3 |
2 files changed, 6 insertions, 1 deletions
diff --git a/sys/netsmb/smb_conn.c b/sys/netsmb/smb_conn.c index d58bc72..adc171c 100644 --- a/sys/netsmb/smb_conn.c +++ b/sys/netsmb/smb_conn.c @@ -683,7 +683,9 @@ int smb_vc_disconnect(struct smb_vc *vcp) { - smb_iod_request(vcp->vc_iod, SMBIOD_EV_DISCONNECT | SMBIOD_EV_SYNC, NULL); + if (vcp->vc_iod != NULL) + smb_iod_request(vcp->vc_iod, SMBIOD_EV_DISCONNECT | + SMBIOD_EV_SYNC, NULL); return 0; } diff --git a/sys/netsmb/smb_iod.c b/sys/netsmb/smb_iod.c index ae5c6f7..412f816 100644 --- a/sys/netsmb/smb_iod.c +++ b/sys/netsmb/smb_iod.c @@ -690,6 +690,9 @@ smb_iod_create(struct smb_vc *vcp) RFNOWAIT, 0, "smbiod%d", iod->iod_id); if (error) { SMBERROR("can't start smbiod: %d", error); + vcp->vc_iod = NULL; + smb_sl_destroy(&iod->iod_rqlock); + smb_sl_destroy(&iod->iod_evlock); free(iod, M_SMBIOD); return error; } |