diff options
| author | Alexander Bluhm <bluhm@cvs.openbsd.org> | 2017-01-15 23:18:06 +0000 |
|---|---|---|
| committer | Alexander Bluhm <bluhm@cvs.openbsd.org> | 2017-01-15 23:18:06 +0000 |
| commit | ed6c7b0d5dfb23ddff5f23812df7667be45c8dea (patch) | |
| tree | f6b0e1c24a4afc07ce278ba83d0862c92258c030 /sys/kern/vfs_syscalls.c | |
| parent | 1542715b44934b0e71e08a29f63c6b3f0d813d7b (diff) | |
When traversing the mount list, the current mount point is locked
with vfs_busy(). If the FOREACH_SAFE macro is used, the next pointer
is not locked and could be freed by another process. Unless
necessary, do not use _SAFE as it is unsafe. In vfs_unmountall()
the current pointer is actullay freed. Add a comment that this
race has to be fixed later.
OK krw@
Diffstat (limited to 'sys/kern/vfs_syscalls.c')
| -rw-r--r-- | sys/kern/vfs_syscalls.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/sys/kern/vfs_syscalls.c b/sys/kern/vfs_syscalls.c index b0eba9d50b9..04df68e17d4 100644 --- a/sys/kern/vfs_syscalls.c +++ b/sys/kern/vfs_syscalls.c @@ -1,4 +1,4 @@ -/* $OpenBSD: vfs_syscalls.c,v 1.267 2017/01/10 20:13:17 bluhm Exp $ */ +/* $OpenBSD: vfs_syscalls.c,v 1.268 2017/01/15 23:18:05 bluhm Exp $ */ /* $NetBSD: vfs_syscalls.c,v 1.71 1996/04/23 10:29:02 mycroft Exp $ */ /* @@ -425,10 +425,10 @@ struct ctldebug debug0 = { "syncprt", &syncprt }; int sys_sync(struct proc *p, void *v, register_t *retval) { - struct mount *mp, *nmp; + struct mount *mp; int asyncflag; - TAILQ_FOREACH_REVERSE_SAFE(mp, &mountlist, mntlist, mnt_list, nmp) { + TAILQ_FOREACH_REVERSE(mp, &mountlist, mntlist, mnt_list) { if (vfs_busy(mp, VB_READ|VB_NOWAIT)) continue; if ((mp->mnt_flag & MNT_RDONLY) == 0) { @@ -570,7 +570,7 @@ sys_getfsstat(struct proc *p, void *v, register_t *retval) syscallarg(size_t) bufsize; syscallarg(int) flags; } */ *uap = v; - struct mount *mp, *nmp; + struct mount *mp; struct statfs *sp; struct statfs *sfsp; size_t count, maxcount; @@ -580,7 +580,7 @@ sys_getfsstat(struct proc *p, void *v, register_t *retval) sfsp = SCARG(uap, buf); count = 0; - TAILQ_FOREACH_SAFE(mp, &mountlist, mnt_list, nmp) { + TAILQ_FOREACH(mp, &mountlist, mnt_list) { if (vfs_busy(mp, VB_READ|VB_NOWAIT)) continue; if (sfsp && count < maxcount) { |