diff options
| author | kib <kib@FreeBSD.org> | 2008-12-18 12:01:19 +0000 |
|---|---|---|
| committer | kib <kib@FreeBSD.org> | 2008-12-18 12:01:19 +0000 |
| commit | 5b3918fe075f9cb971c03bd21b43f199996e2085 (patch) | |
| tree | 23a44433d9c47bead44c14342d652064c858aa89 /sys/kern/sys_socket.c | |
| parent | fe785ac856e74cb4f13d1a522b6c71392542707f (diff) | |
| download | FreeBSD-src-5b3918fe075f9cb971c03bd21b43f199996e2085.zip FreeBSD-src-5b3918fe075f9cb971c03bd21b43f199996e2085.tar.gz | |
The quotactl, statfs and fstatfs syscall implementations may dereference
NULL pointer to struct mount if the looked up vnode is reclaimed. Also,
these syscalls only mnt_ref() the mp, still allowing it to be unmounted;
only struct mount memory is kept from being reused.
Lock the vnode when doing name lookup, then reference its mount point,
unlock the vnode and vfs_busy the mountpoint. This sequence shall take
care of both races.
Reported and tested by: pho
Discussed with: attilio
MFC after: 1 month
Diffstat (limited to 'sys/kern/sys_socket.c')
0 files changed, 0 insertions, 0 deletions
