diff options
| author | oster <oster@NetBSD.org> | 2007-12-18 01:09:46 +0000 |
|---|---|---|
| committer | oster <oster@NetBSD.org> | 2007-12-18 01:09:46 +0000 |
| commit | 257eb7f26ae03052a13938ba09b69a9b9ed51f60 (patch) | |
| tree | 4c30d685cfbed900ca0d50c915795a62305a6a7e /sys/dev/raidframe | |
| parent | ece8110f42963dabbadfdb7097c0c84477dd0c18 (diff) | |
Fix a 'use after free' issue with wedges and RAIDframe.
Problem reported and fix tested by Jeff Rizzo (Thanks!).
Diffstat (limited to 'sys/dev/raidframe')
| -rw-r--r-- | sys/dev/raidframe/rf_netbsdkintf.c | 16 |
1 files changed, 10 insertions, 6 deletions
diff --git a/sys/dev/raidframe/rf_netbsdkintf.c b/sys/dev/raidframe/rf_netbsdkintf.c index 389c0408915..2d3d898ec20 100644 --- a/sys/dev/raidframe/rf_netbsdkintf.c +++ b/sys/dev/raidframe/rf_netbsdkintf.c @@ -1,4 +1,4 @@ -/* $NetBSD: rf_netbsdkintf.c,v 1.240 2007/12/11 01:54:46 oster Exp $ */ +/* $NetBSD: rf_netbsdkintf.c,v 1.241 2007/12/18 01:09:46 oster Exp $ */ /*- * Copyright (c) 1996, 1997, 1998 The NetBSD Foundation, Inc. * All rights reserved. @@ -146,7 +146,7 @@ ***********************************************************/ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: rf_netbsdkintf.c,v 1.240 2007/12/11 01:54:46 oster Exp $"); +__KERNEL_RCSID(0, "$NetBSD: rf_netbsdkintf.c,v 1.241 2007/12/18 01:09:46 oster Exp $"); #include <sys/param.h> #include <sys/errno.h> @@ -2908,17 +2908,21 @@ rf_find_raid_components() struct dkwedge_info dkw; error = VOP_IOCTL(vp, DIOCGWEDGEINFO, &dkw, FREAD, NOCRED); - vn_lock(vp, LK_EXCLUSIVE | LK_RETRY); - VOP_CLOSE(vp, FREAD | FWRITE, NOCRED); - vput(vp); if (error) { printf("RAIDframe: can't get wedge info for " "dev %s (%d)\n", dv->dv_xname, error); + vn_lock(vp, LK_EXCLUSIVE | LK_RETRY); + VOP_CLOSE(vp, FREAD | FWRITE, NOCRED); + vput(vp); continue; } - if (strcmp(dkw.dkw_ptype, DKW_PTYPE_RAIDFRAME) != 0) + if (strcmp(dkw.dkw_ptype, DKW_PTYPE_RAIDFRAME) != 0) { + vn_lock(vp, LK_EXCLUSIVE | LK_RETRY); + VOP_CLOSE(vp, FREAD | FWRITE, NOCRED); + vput(vp); continue; + } ac_list = rf_get_component(ac_list, dev, vp, dv->dv_xname, dkw.dkw_size); |
