From 257eb7f26ae03052a13938ba09b69a9b9ed51f60 Mon Sep 17 00:00:00 2001 From: oster Date: Tue, 18 Dec 2007 01:09:46 +0000 Subject: Fix a 'use after free' issue with wedges and RAIDframe. Problem reported and fix tested by Jeff Rizzo (Thanks!). --- sys/dev/raidframe/rf_netbsdkintf.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) (limited to 'sys/dev/raidframe') diff --git a/sys/dev/raidframe/rf_netbsdkintf.c b/sys/dev/raidframe/rf_netbsdkintf.c index 389c0408915..2d3d898ec20 100644 --- a/sys/dev/raidframe/rf_netbsdkintf.c +++ b/sys/dev/raidframe/rf_netbsdkintf.c @@ -1,4 +1,4 @@ -/* $NetBSD: rf_netbsdkintf.c,v 1.240 2007/12/11 01:54:46 oster Exp $ */ +/* $NetBSD: rf_netbsdkintf.c,v 1.241 2007/12/18 01:09:46 oster Exp $ */ /*- * Copyright (c) 1996, 1997, 1998 The NetBSD Foundation, Inc. * All rights reserved. @@ -146,7 +146,7 @@ ***********************************************************/ #include -__KERNEL_RCSID(0, "$NetBSD: rf_netbsdkintf.c,v 1.240 2007/12/11 01:54:46 oster Exp $"); +__KERNEL_RCSID(0, "$NetBSD: rf_netbsdkintf.c,v 1.241 2007/12/18 01:09:46 oster Exp $"); #include #include @@ -2908,17 +2908,21 @@ rf_find_raid_components() struct dkwedge_info dkw; error = VOP_IOCTL(vp, DIOCGWEDGEINFO, &dkw, FREAD, NOCRED); - vn_lock(vp, LK_EXCLUSIVE | LK_RETRY); - VOP_CLOSE(vp, FREAD | FWRITE, NOCRED); - vput(vp); if (error) { printf("RAIDframe: can't get wedge info for " "dev %s (%d)\n", dv->dv_xname, error); + vn_lock(vp, LK_EXCLUSIVE | LK_RETRY); + VOP_CLOSE(vp, FREAD | FWRITE, NOCRED); + vput(vp); continue; } - if (strcmp(dkw.dkw_ptype, DKW_PTYPE_RAIDFRAME) != 0) + if (strcmp(dkw.dkw_ptype, DKW_PTYPE_RAIDFRAME) != 0) { + vn_lock(vp, LK_EXCLUSIVE | LK_RETRY); + VOP_CLOSE(vp, FREAD | FWRITE, NOCRED); + vput(vp); continue; + } ac_list = rf_get_component(ac_list, dev, vp, dv->dv_xname, dkw.dkw_size); -- cgit