diff options
| author | wpaul <wpaul@FreeBSD.org> | 1999-07-30 04:02:04 +0000 |
|---|---|---|
| committer | wpaul <wpaul@FreeBSD.org> | 1999-07-30 04:02:04 +0000 |
| commit | 9bf69787ba6dfbf106b448393810d0efb17278c5 (patch) | |
| tree | a9fbeff4b90d8c12ee6e22a7c8c7dc7adfc3a16a /sys/nfs | |
| parent | a448a2abc0a97d419f473e28d2c9f226e04fc9e7 (diff) | |
| download | FreeBSD-src-9bf69787ba6dfbf106b448393810d0efb17278c5.zip FreeBSD-src-9bf69787ba6dfbf106b448393810d0efb17278c5.tar.gz | |
Fix two bugs in nfs_readdirplus(). The first is that in some cases,
vnodes are locked and never unlocked, which leads to processes starting
to wedge up after doing a mount -o nfsv3,tcp,rdirplus foo:/fs /fs; ls /fs.
The second is that sometimes cnp is accessed without having been
properly initialized: cnp->cn_nameptr points to an earlier name while
"len" contains the length of a current name of different size. This
leads to an attempt to dereference *(cn->cn_nameptr + len) which will
sometimes cause a page fault and a panic.
With these two fixes, client side readdirplus works correctly with
FreeBSD, IRIX 6.5.4 and Solaris 2.5.1 and 2.6 servers.
Submitted by: Matthew Dillon <dillon@backplane.com>
Diffstat (limited to 'sys/nfs')
| -rw-r--r-- | sys/nfs/nfs_vnops.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/sys/nfs/nfs_vnops.c b/sys/nfs/nfs_vnops.c index d95ed0a..72e67f6 100644 --- a/sys/nfs/nfs_vnops.c +++ b/sys/nfs/nfs_vnops.c @@ -34,7 +34,7 @@ * SUCH DAMAGE. * * @(#)nfs_vnops.c 8.16 (Berkeley) 5/27/95 - * $Id: nfs_vnops.c,v 1.134 1999/06/30 02:53:51 julian Exp $ + * $Id: nfs_vnops.c,v 1.135 1999/07/01 13:32:54 peter Exp $ */ @@ -2343,7 +2343,7 @@ nfs_readdirplusrpc(vp, uiop, cred) newvp = NFSTOV(np); } } - if (doit) { + if (doit && bigenough) { dpossav2 = dpos; dpos = dpossav1; mdsav2 = md; @@ -2367,7 +2367,10 @@ nfs_readdirplusrpc(vp, uiop, cred) nfsm_adv(nfsm_rndup(i)); } if (newvp != NULLVP) { - vrele(newvp); + if (newvp == vp) + vrele(newvp); + else + vput(newvp); newvp = NULLVP; } nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED); |
