Author: trasz
Date: Sat Jun 23 18:26:23 2012
New Revision: 237490
URL: http://svn.freebsd.org/changeset/base/237490
Log:
MFC r234036:
Fix panic in ffs_reload(), which may happen when read-only filesystem
gets resized and then reloaded.
MFC r234537:
Fix use-after-free introduced in r234036.
Modified:
stable/9/sys/ufs/ffs/ffs_vfsops.c
Directory Properties:
stable/9/sys/ (props changed)
Modified: stable/9/sys/ufs/ffs/ffs_vfsops.c
==============================================================================
--- stable/9/sys/ufs/ffs/ffs_vfsops.c Sat Jun 23 18:07:48 2012
(r237489)
+++ stable/9/sys/ufs/ffs/ffs_vfsops.c Sat Jun 23 18:26:23 2012
(r237490)
@@ -675,8 +675,14 @@ ffs_reload(struct mount *mp, struct thre
/*
* Step 3: re-read summary information from disk.
*/
- blks = howmany(fs->fs_cssize, fs->fs_fsize);
- space = fs->fs_csp;
+ size = fs->fs_cssize;
+ blks = howmany(size, fs->fs_fsize);
+ if (fs->fs_contigsumsize > 0)
+ size += fs->fs_ncg * sizeof(int32_t);
+ size += fs->fs_ncg * sizeof(u_int8_t);
+ free(fs->fs_csp, M_UFSMNT);
+ space = malloc((u_long)size, M_UFSMNT, M_WAITOK);
+ fs->fs_csp = space;
for (i = 0; i < blks; i += fs->fs_frag) {
size = fs->fs_bsize;
if (i + fs->fs_frag > blks)
@@ -693,10 +699,14 @@ ffs_reload(struct mount *mp, struct thre
* We no longer know anything about clusters per cylinder group.
*/
if (fs->fs_contigsumsize > 0) {
- lp = fs->fs_maxcluster;
+ fs->fs_maxcluster = lp = space;
for (i = 0; i < fs->fs_ncg; i++)
*lp++ = fs->fs_contigsumsize;
+ space = lp;
}
+ size = fs->fs_ncg * sizeof(u_int8_t);
+ fs->fs_contigdirs = (u_int8_t *)space;
+ bzero(fs->fs_contigdirs, size);
loop:
MNT_VNODE_FOREACH_ALL(vp, mp, mvp) {
_______________________________________________
svn-src-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
