NetBSD Problem Report #51617

From dholland@netbsd.org  Wed Nov  9 05:36:43 2016
Return-Path: <dholland@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(Client CN "mail.netbsd.org", Issuer "Postmaster NetBSD.org" (verified OK))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 99EA77A278
	for <gnats-bugs@gnats.NetBSD.org>; Wed,  9 Nov 2016 05:36:43 +0000 (UTC)
Message-Id: <20161109053643.5C74E855AF@mail.netbsd.org>
Date: Wed,  9 Nov 2016 05:36:43 +0000 (UTC)
From: dholland@NetBSD.org
Reply-To: dholland@NetBSD.org
To: gnats-bugs@NetBSD.org
Subject: locking a bad vnode pointer in ufs_extattr_autocreate_attr()
X-Send-Pr-Version: 3.95

>Number:         51617
>Category:       kern
>Synopsis:       locking a bad vnode pointer in ufs_extattr_autocreate_attr()
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Nov 09 05:40:00 +0000 2016
>Originator:     David A. Holland
>Release:        NetBSD 7.99.40 (20161022)
>Organization:
>Environment:
System: n/a
Architecture: all
Machine: all
>Description:

ufs_extattr_autocreate_attr() calls vn_open() but doesn't check for
failure until after it's already attempted to lock the (potentially
invalid/uninitialized) result vnode.

>How-To-Repeat:

code reading

>Fix:

Like in 51616 I would appreciate if one of the people who has been
prodding this code could eyeball this patch, just in case I'm missing
something.


diff -r 2ec55b83ddc6 sys/ufs/ufs/ufs_extattr.c
--- a/sys/ufs/ufs/ufs_extattr.c	Wed Nov 09 00:28:21 2016 -0500
+++ b/sys/ufs/ufs/ufs_extattr.c	Wed Nov 09 00:31:27 2016 -0500
@@ -341,8 +341,10 @@ ufs_extattr_autocreate_attr(struct vnode
 	/*
 	 * Reacquire the lock on the vnode
 	 */
-	KASSERT(VOP_ISLOCKED(vp) == 0);
-	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
+	if (error == 0) {
+		KASSERT(VOP_ISLOCKED(vp) == 0);
+		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
+	}

 	ufs_extattr_uepm_lock(ump);

Home	PR Database Search