NetBSD Problem Report #51616

From dholland@netbsd.org  Wed Nov  9 04:37:03 2016
Return-Path: <dholland@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(Client CN "mail.netbsd.org", Issuer "Postmaster NetBSD.org" (verified OK))
	by mollari.NetBSD.org (Postfix) with ESMTPS id BB9EE7A16D
	for <gnats-bugs@gnats.NetBSD.org>; Wed,  9 Nov 2016 04:37:02 +0000 (UTC)
Message-Id: <20161109043702.7CAF5855AB@mail.netbsd.org>
Date: Wed,  9 Nov 2016 04:37:02 +0000 (UTC)
From: dholland@NetBSD.org
Reply-To: dholland@NetBSD.org
To: gnats-bugs@NetBSD.org
Subject: double unlock in ufs_extattr
X-Send-Pr-Version: 3.95

>Number:         51616
>Category:       kern
>Synopsis:       double unlock in ufs_extattr
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Nov 09 04:40:00 +0000 2016
>Originator:     David A. Holland
>Release:        NetBSD 7.99.40 (20161022)
>Organization:
>Environment:
System: n/a
Architecture: all
Machine: all
>Description:

ufs_extattr_rm has special-case logic to avoid double-locking an
attribute backing vnode when working on an attribute *for* the backing
vnode; but this logic is missing for the corresponding unlock, leading
to a double unlock and panic.

>How-To-Repeat:

code reading.

>Fix:

I would appreciate if one of the people who has been prodding this
code could eyeball this patch, just in case I'm missing something.


Index: ufs/ufs_extattr.c
===================================================================
RCS file: /cvsroot/src/sys/ufs/ufs/ufs_extattr.c,v
retrieving revision 1.47
diff -u -p -r1.47 ufs_extattr.c
--- ufs/ufs_extattr.c	7 Jul 2016 06:55:44 -0000	1.47
+++ ufs/ufs_extattr.c	9 Nov 2016 04:33:30 -0000
@@ -1589,7 +1589,8 @@ ufs_extattr_rm(struct vnode *vp, int att
 		error = ENXIO;

  vopunlock_exit:
-	VOP_UNLOCK(attribute->uele_backing_vnode);
+	if (attribute->uele_backing_vnode != vp)
+		VOP_UNLOCK(attribute->uele_backing_vnode);

 	return (error);
 }
Index: lfs/ulfs_extattr.c
===================================================================
RCS file: /cvsroot/src/sys/ufs/lfs/ulfs_extattr.c,v
retrieving revision 1.13
diff -u -p -r1.13 ulfs_extattr.c
--- lfs/ulfs_extattr.c	7 Jul 2016 06:55:44 -0000	1.13
+++ lfs/ulfs_extattr.c	9 Nov 2016 04:33:30 -0000
@@ -1589,7 +1589,8 @@ ulfs_extattr_rm(struct vnode *vp, int at
 		error = ENXIO;

  vopunlock_exit:
-	VOP_UNLOCK(attribute->uele_backing_vnode);
+	if (attribute->uele_backing_vnode != vp)
+		VOP_UNLOCK(attribute->uele_backing_vnode);

 	return (error);
 }

Home	PR Database Search