diff options
author | rwatson <rwatson@FreeBSD.org> | 2003-01-31 18:57:04 +0000 |
---|---|---|
committer | rwatson <rwatson@FreeBSD.org> | 2003-01-31 18:57:04 +0000 |
commit | 21c1d8195b50267aae0a7fab1818325efba304b9 (patch) | |
tree | 617d31a18f34f2e5e55f73256d2eb7da0cf5f974 /sys | |
parent | bbd6f8d1ffbdc0e2ac4ee33b9ee2e87396fb2b59 (diff) | |
download | FreeBSD-src-21c1d8195b50267aae0a7fab1818325efba304b9.zip FreeBSD-src-21c1d8195b50267aae0a7fab1818325efba304b9.tar.gz |
Clean up vnode handling on return from chroot() in certain error
cases: we might multiply vrele() a vnode when certain classes of
failures occur. This appears to stem from earlier Giant/file
descriptor lock pushdown and restructuring.
Submitted by: maxim
Diffstat (limited to 'sys')
-rw-r--r-- | sys/kern/vfs_extattr.c | 6 | ||||
-rw-r--r-- | sys/kern/vfs_syscalls.c | 6 |
2 files changed, 8 insertions, 4 deletions
diff --git a/sys/kern/vfs_extattr.c b/sys/kern/vfs_extattr.c index 2fbdcfe..3752f0c 100644 --- a/sys/kern/vfs_extattr.c +++ b/sys/kern/vfs_extattr.c @@ -542,8 +542,10 @@ chroot(td, uap) if ((error = change_dir(&nd, td)) != 0) goto error; #ifdef MAC - if ((error = mac_check_vnode_chroot(td->td_ucred, nd.ni_vp))) + if ((error = mac_check_vnode_chroot(td->td_ucred, nd.ni_vp))) { + vput(vp); goto error; + } #endif FILEDESC_LOCK(fdp); if (chroot_allow_open_directories == 0 || @@ -567,7 +569,7 @@ error_unlock: FILEDESC_UNLOCK(fdp); error: mtx_unlock(&Giant); - NDFREE(&nd, 0); + NDFREE(&nd, NDF_ONLY_PNBUF); return (error); } diff --git a/sys/kern/vfs_syscalls.c b/sys/kern/vfs_syscalls.c index 2fbdcfe..3752f0c 100644 --- a/sys/kern/vfs_syscalls.c +++ b/sys/kern/vfs_syscalls.c @@ -542,8 +542,10 @@ chroot(td, uap) if ((error = change_dir(&nd, td)) != 0) goto error; #ifdef MAC - if ((error = mac_check_vnode_chroot(td->td_ucred, nd.ni_vp))) + if ((error = mac_check_vnode_chroot(td->td_ucred, nd.ni_vp))) { + vput(vp); goto error; + } #endif FILEDESC_LOCK(fdp); if (chroot_allow_open_directories == 0 || @@ -567,7 +569,7 @@ error_unlock: FILEDESC_UNLOCK(fdp); error: mtx_unlock(&Giant); - NDFREE(&nd, 0); + NDFREE(&nd, NDF_ONLY_PNBUF); return (error); } |