diff options
| author |   bluhm <bluhm@openbsd.org> | 2016-05-22 20:27:04 +0000 |
|---|---|---|
| committer | bluhm <bluhm@openbsd.org> | 2016-05-22 20:27:04 +0000 |
| commit | 9ee302b807409cb1f9713adc404a77fe222e525c (patch) | |
| tree | aa5fe5ae4375c8135911855d360673c191e7e222 /sys/msdosfs | |
| parent | makes sure the value of the asprintf buffer is zeroed on error (diff) | |
| download | wireguard-openbsd-9ee302b807409cb1f9713adc404a77fe222e525c.tar.xz wireguard-openbsd-9ee302b807409cb1f9713adc404a77fe222e525c.zip | |
When pulling an msdos formated umass stick during mount while the
usb stack was busy, the kernel could trigger an uvm fault. There
is a race between vop_generic_revoke() and sys_mount() where vgonel()
could reset v_specinfo. Then v_specmountpoint is no longer valid.
So after sleeping, msdosfs_mountfs() could crash in the error path.
The code in the different *_mountfs() functions was inconsistent,
implement the same check everywhere.
OK krw@ natano@
Diffstat (limited to 'sys/msdosfs')
| -rw-r--r-- | sys/msdosfs/msdosfs_vfsops.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/sys/msdosfs/msdosfs_vfsops.c b/sys/msdosfs/msdosfs_vfsops.c index 1609246478d..01b90342d53 100644 --- a/sys/msdosfs/msdosfs_vfsops.c +++ b/sys/msdosfs/msdosfs_vfsops.c @@ -1,4 +1,4 @@ -/* $OpenBSD: msdosfs_vfsops.c,v 1.77 2016/04/26 18:37:03 natano Exp $ */ +/* $OpenBSD: msdosfs_vfsops.c,v 1.78 2016/05/22 20:27:04 bluhm Exp $ */ /* $NetBSD: msdosfs_vfsops.c,v 1.48 1997/10/18 02:54:57 briggs Exp $ */ /*- @@ -583,7 +583,8 @@ msdosfs_mountfs(struct vnode *devvp, struct mount *mp, struct proc *p, return (0); error_exit: - devvp->v_specmountpoint = NULL; + if (devvp->v_specinfo) + devvp->v_specmountpoint = NULL; if (bp) brelse(bp); |