summaryrefslogtreecommitdiff
path: root/sys/dev/raidframe
diff options
context:
space:
mode:
authoroster <oster@NetBSD.org>2007-12-18 01:09:46 +0000
committeroster <oster@NetBSD.org>2007-12-18 01:09:46 +0000
commit257eb7f26ae03052a13938ba09b69a9b9ed51f60 (patch)
tree4c30d685cfbed900ca0d50c915795a62305a6a7e /sys/dev/raidframe
parentece8110f42963dabbadfdb7097c0c84477dd0c18 (diff)
Fix a 'use after free' issue with wedges and RAIDframe.
Problem reported and fix tested by Jeff Rizzo (Thanks!).
Diffstat (limited to 'sys/dev/raidframe')
-rw-r--r--sys/dev/raidframe/rf_netbsdkintf.c16
1 files changed, 10 insertions, 6 deletions
diff --git a/sys/dev/raidframe/rf_netbsdkintf.c b/sys/dev/raidframe/rf_netbsdkintf.c
index 389c0408915..2d3d898ec20 100644
--- a/sys/dev/raidframe/rf_netbsdkintf.c
+++ b/sys/dev/raidframe/rf_netbsdkintf.c
@@ -1,4 +1,4 @@
-/* $NetBSD: rf_netbsdkintf.c,v 1.240 2007/12/11 01:54:46 oster Exp $ */
+/* $NetBSD: rf_netbsdkintf.c,v 1.241 2007/12/18 01:09:46 oster Exp $ */
/*-
* Copyright (c) 1996, 1997, 1998 The NetBSD Foundation, Inc.
* All rights reserved.
@@ -146,7 +146,7 @@
***********************************************************/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: rf_netbsdkintf.c,v 1.240 2007/12/11 01:54:46 oster Exp $");
+__KERNEL_RCSID(0, "$NetBSD: rf_netbsdkintf.c,v 1.241 2007/12/18 01:09:46 oster Exp $");
#include <sys/param.h>
#include <sys/errno.h>
@@ -2908,17 +2908,21 @@ rf_find_raid_components()
struct dkwedge_info dkw;
error = VOP_IOCTL(vp, DIOCGWEDGEINFO, &dkw, FREAD,
NOCRED);
- vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
- VOP_CLOSE(vp, FREAD | FWRITE, NOCRED);
- vput(vp);
if (error) {
printf("RAIDframe: can't get wedge info for "
"dev %s (%d)\n", dv->dv_xname, error);
+ vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
+ VOP_CLOSE(vp, FREAD | FWRITE, NOCRED);
+ vput(vp);
continue;
}
- if (strcmp(dkw.dkw_ptype, DKW_PTYPE_RAIDFRAME) != 0)
+ if (strcmp(dkw.dkw_ptype, DKW_PTYPE_RAIDFRAME) != 0) {
+ vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
+ VOP_CLOSE(vp, FREAD | FWRITE, NOCRED);
+ vput(vp);
continue;
+ }
ac_list = rf_get_component(ac_list, dev, vp,
dv->dv_xname, dkw.dkw_size);