diff options
| author | avg <avg@FreeBSD.org> | 2014-01-16 12:31:27 +0000 |
|---|---|---|
| committer | avg <avg@FreeBSD.org> | 2014-01-16 12:31:27 +0000 |
| commit | 113f9a4f5312f631ee8d97ab8641c3064e6a60ca (patch) | |
| tree | 7ac5504788b5bfc10e5576883494ab6eefced246 /sys/cddl | |
| parent | 31b7f68d805af95d0ed2e9b768ef212042854498 (diff) | |
| download | FreeBSD-src-113f9a4f5312f631ee8d97ab8641c3064e6a60ca.zip FreeBSD-src-113f9a4f5312f631ee8d97ab8641c3064e6a60ca.tar.gz | |
zfs_deleteextattr: name buffer from namei is needed by zfs_rename
If we prematurely free the name buffer and it gets quickly recycled,
then zfs_rename may see data from another lookup or even unmapped memory
via cn_nameptr.
MFC after: 6 days
Sponsored by: HybridCluster
Diffstat (limited to 'sys/cddl')
| -rw-r--r-- | sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_vnops.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_vnops.c b/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_vnops.c index 8699110..3e43b48 100644 --- a/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_vnops.c +++ b/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_vnops.c @@ -6774,14 +6774,16 @@ vop_deleteextattr { UIO_SYSSPACE, attrname, xvp, td); error = namei(&nd); vp = nd.ni_vp; - NDFREE(&nd, NDF_ONLY_PNBUF); if (error != 0) { ZFS_EXIT(zfsvfs); + NDFREE(&nd, NDF_ONLY_PNBUF); if (error == ENOENT) error = ENOATTR; return (error); } + error = VOP_REMOVE(nd.ni_dvp, vp, &nd.ni_cnd); + NDFREE(&nd, NDF_ONLY_PNBUF); vput(nd.ni_dvp); if (vp == nd.ni_dvp) |
