Page MenuHomeFreeBSD
Files F162606129

D55755.diff
No OneTemporary
Actions

D55755.diff
View Options

diff --git a/sys/fs/p9fs/p9fs_vfsops.c b/sys/fs/p9fs/p9fs_vfsops.c
--- a/sys/fs/p9fs/p9fs_vfsops.c
+++ b/sys/fs/p9fs/p9fs_vfsops.c
@@ -366,6 +366,12 @@
error = vfs_hash_insert(vp, hash, flags, td, vpp,
p9fs_node_cmp, &fid->qid);
if (error != 0) {
+ /*
+ * vfs_hash_insert() found a duplicate vnode and called
+ * vgone() on vp, which triggered p9fs_reclaim() and freed np.
+ * Clear np to prevent a double-free in the out: label.
+ */
+ np = NULL;
goto out;
}
@@ -378,18 +384,16 @@
*vpp = vp;
} else {
/*
- * Returning matching vp found in hashlist.
- * So cleanup the np allocated above in this context.
+ * vfs_hash_insert() found a matching vnode and called vgone()
+ * on vp, which triggered p9fs_reclaim() and freed np.
*/
- if (!IS_ROOT(np)) {
- p9fs_destroy_node(&np);
- }
+ np = NULL;
}
return (0);
out:
/* Something went wrong, dispose the node */
- if (!IS_ROOT(np)) {
+ if (np != NULL && !IS_ROOT(np)) {
p9fs_destroy_node(&np);
}
diff --git a/sys/fs/p9fs/p9fs_vnops.c b/sys/fs/p9fs/p9fs_vnops.c
--- a/sys/fs/p9fs/p9fs_vnops.c
+++ b/sys/fs/p9fs/p9fs_vnops.c
@@ -113,17 +113,24 @@
if ((np->flags & P9FS_NODE_IN_SESSION) != 0) {
np->flags &= ~P9FS_NODE_IN_SESSION;
STAILQ_REMOVE(&vses->virt_node_list, np, p9fs_node, p9fs_node_next);
- } else {
P9FS_UNLOCK(vses);
- return;
- }
- P9FS_UNLOCK(vses);
- /* Invalidate all entries to a particular vnode. */
- cache_purge(vp);
+ /* Invalidate all entries to a particular vnode. */
+ cache_purge(vp);
- /* Destroy the vm object and flush associated pages. */
- vnode_destroy_vobject(vp);
+ /* Destroy the vm object and flush associated pages. */
+ vnode_destroy_vobject(vp);
+ } else {
+ /*
+ * The node was never added to the session list, meaning it
+ * was allocated in p9fs_vget_common but vfs_hash_insert()
+ * found a duplicate and called vgone() on us before we could
+ * add ourselves. We must still release FIDs and dispose the
+ * node to ensure vp->v_data is cleared before freevnode()
+ * checks it.
+ */
+ P9FS_UNLOCK(vses);
+ }
/* Remove all the FID */
p9fs_fid_remove_all(np, FALSE);

File Metadata

Mime Type
text/plain
Expires
Wed, Jul 15, 11:44 PM (10 h, 44 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
35119426
Default Alt Text
D55755.diff (2 KB)

Event Timeline