diff options
| author | kib <kib@FreeBSD.org> | 2012-02-22 20:03:51 +0000 |
|---|---|---|
| committer | kib <kib@FreeBSD.org> | 2012-02-22 20:03:51 +0000 |
| commit | 18c16300867db8462cf50551aa7d21c6859c8678 (patch) | |
| tree | 5cf27c48f4c040d9285354467c307741ffc3ba3f /sys/ufs | |
| parent | ac9e4627bbd667a9b74051867a1be4efd51df961 (diff) | |
| download | FreeBSD-src-18c16300867db8462cf50551aa7d21c6859c8678.zip FreeBSD-src-18c16300867db8462cf50551aa7d21c6859c8678.tar.gz | |
Properly lock DQREF() with dqhlock. Missed locking caused counter
corruption.
Assert that the dq reference value is sane before decrementing it.
Reported and tested by: pho
MFC after: 1 week
Diffstat (limited to 'sys/ufs')
| -rw-r--r-- | sys/ufs/ufs/ufs_quota.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/sys/ufs/ufs/ufs_quota.c b/sys/ufs/ufs/ufs_quota.c index ce89efa..b652bec 100644 --- a/sys/ufs/ufs/ufs_quota.c +++ b/sys/ufs/ufs/ufs_quota.c @@ -1469,6 +1469,7 @@ dqrele(struct vnode *vp, struct dquot *dq) if (dq == NODQUOT) return; DQH_LOCK(); + KASSERT(dq->dq_cnt > 0, ("Lost dq %p reference 1", dq)); if (dq->dq_cnt > 1) { dq->dq_cnt--; DQH_UNLOCK(); @@ -1479,6 +1480,7 @@ sync: (void) dqsync(vp, dq); DQH_LOCK(); + KASSERT(dq->dq_cnt > 0, ("Lost dq %p reference 2", dq)); if (--dq->dq_cnt > 0) { DQH_UNLOCK(); @@ -1658,6 +1660,7 @@ quotaref(vp, qrp) */ found = 0; ip = VTOI(vp); + mtx_lock(&dqhlock); for (i = 0; i < MAXQUOTAS; i++) { if ((dq = ip->i_dquot[i]) == NODQUOT) continue; @@ -1665,6 +1668,7 @@ quotaref(vp, qrp) qrp[i] = dq; found++; } + mtx_unlock(&dqhlock); return (found); } |
