Change Details

This fixes another almost-insta-panic for DIAGNOSTIC builds. For those builds, namei will clear HASBUF and cn_nameptr() before calling VOP_RMDIR(), resulting in an immediate page fault for unionfs. For non-DIAGNOSTIC builds this is a use-after-freeb bug.

"rm-style" system calls such as kern_frmdirat() and kern_unlinkat() don't supply SAVENAME to preserve the pathname buffer for subsequent vnode ops. For unionfs this poses an issue because the pathname may be needed for a relookup operation in unionfs_remove()/unionfs_rmdir(). Currently unionfs doesn't check for this case, leading to a panic on DIAGNOSTIC kernels and use-after-free of cn_nameptr otherwise. The unionfs node's stored buffer would suffice as a replacement for cnp->cn_nameptr in some (but not all) cases, but it's cleaner to just ensure that unionfs vnode ops always have a valid cn_nameptr by setting SAVENAME in unionfs_lookup(). While here, do some light cleanup in unionfs_lookup() and assert that HASBUF is always present in the relevant relookup calls.

This fixes another almost-insta-panic for DIAGNOSTIC builds. For those "rm-style" system calls such as kern_frmdirat() and kern_unlinkat() builds, namei will clear HASBUF and cn_ don't supply SAVENAME to preserve the pathnameptr() before calling buffer for subsequent VOP_RMDIR(), resulting in an immediate page fault for unionfs. vnode ops. For unionfs this poses an issue because the pathname may For non-DIAGNOSTIC builds this is a use-after-freeb bug be needed for a relookup operation in unionfs_remove()/unionfs_rmdir(). Currently unionfs doesn't check for this case, leading to a panic on DIAGNOSTIC kernels and use-after-free of cn_nameptr otherwise. The unionfs node's stored buffer would suffice as a replacement for cnp->cn_nameptr in some (but not all) cases, but it's cleaner to just ensure that unionfs vnode ops always have a valid cn_nameptr by setting SAVENAME in unionfs_lookup(). While here, do some light cleanup in unionfs_lookup() and assert that HASBUF is always present in the relevant relookup calls.