diff options
author | phk <phk@FreeBSD.org> | 1997-04-13 06:27:09 +0000 |
---|---|---|
committer | phk <phk@FreeBSD.org> | 1997-04-13 06:27:09 +0000 |
commit | 69934522f723a52b4a83a27a0996b92a17c0a9a2 (patch) | |
tree | 2cb8d2d901ea274dbdae5e5fa0ca69c5189e46c2 /sys | |
parent | 6191d4d12f8b04a35f97dc8ce2cd8f141b5cd696 (diff) | |
download | FreeBSD-src-69934522f723a52b4a83a27a0996b92a17c0a9a2.zip FreeBSD-src-69934522f723a52b4a83a27a0996b92a17c0a9a2.tar.gz |
The path name buffer, cn->cn_pnbuf, is FREEed by VOP_MKDIR when
relookup() in union_relookup() is succeeded. However, if relookup()
returns non-zero value, that is relookup fails, VOP_MKDIR is never
called (c.f. union_mkshadow). Thus, pathname buffer is never FREEed.
Reviewed by: phk
Submitted by: kato
PR: 3262
Diffstat (limited to 'sys')
-rw-r--r-- | sys/fs/unionfs/union_subr.c | 6 | ||||
-rw-r--r-- | sys/miscfs/union/union_subr.c | 6 |
2 files changed, 10 insertions, 2 deletions
diff --git a/sys/fs/unionfs/union_subr.c b/sys/fs/unionfs/union_subr.c index 8868b2a..e37593d 100644 --- a/sys/fs/unionfs/union_subr.c +++ b/sys/fs/unionfs/union_subr.c @@ -35,7 +35,7 @@ * SUCH DAMAGE. * * @(#)union_subr.c 8.20 (Berkeley) 5/20/95 - * $Id: union_subr.c,v 1.15 1997/03/23 03:36:59 bde Exp $ + * $Id: union_subr.c,v 1.16 1997/04/13 06:25:03 phk Exp $ */ #include <sys/param.h> @@ -752,6 +752,10 @@ union_relookup(um, dvp, vpp, cnp, cn, path, pathlen) error = relookup(dvp, vpp, cn); if (!error) vrele(dvp); + else { + free(cn->cn_pnbuf, M_NAMEI); + cn->cn_pnbuf = '\0'; + } return (error); } diff --git a/sys/miscfs/union/union_subr.c b/sys/miscfs/union/union_subr.c index 8868b2a..e37593d 100644 --- a/sys/miscfs/union/union_subr.c +++ b/sys/miscfs/union/union_subr.c @@ -35,7 +35,7 @@ * SUCH DAMAGE. * * @(#)union_subr.c 8.20 (Berkeley) 5/20/95 - * $Id: union_subr.c,v 1.15 1997/03/23 03:36:59 bde Exp $ + * $Id: union_subr.c,v 1.16 1997/04/13 06:25:03 phk Exp $ */ #include <sys/param.h> @@ -752,6 +752,10 @@ union_relookup(um, dvp, vpp, cnp, cn, path, pathlen) error = relookup(dvp, vpp, cn); if (!error) vrele(dvp); + else { + free(cn->cn_pnbuf, M_NAMEI); + cn->cn_pnbuf = '\0'; + } return (error); } |