hardenedbsd/HardenedBSD
1
0
Fork 0
mirror of https://git.hardenedbsd.org/hardenedbsd/HardenedBSD.git synced 2024-11-27 11:20:58 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

Properly lock DQREF() with dqhlock. Missed locking caused counter

Browse Source 
corruption.

Assert that the dq reference value is sane before decrementing it.

Reported and tested by:	pho
MFC after:	1 week
This commit is contained in:
Konstantin Belousov 2012-02-22 20:03:51 +00:00
parent 501f538675
commit 2b19466836
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=232003
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
sys/ufs/ufs/ufs_quota.c
View File

@ -1469,6 +1469,7 @@ dqrele(struct vnode *vp, struct dquot *dq)
if (dq == NODQUOT)
return;
DQH_LOCK();
KASSERT(dq->dq_cnt > 0, ("Lost dq %p reference 1", dq));
if (dq->dq_cnt > 1) {
dq->dq_cnt--;
DQH_UNLOCK();
@ -1479,6 +1480,7 @@ sync:
(void) dqsync(vp, dq);
DQH_LOCK();
KASSERT(dq->dq_cnt > 0, ("Lost dq %p reference 2", dq));
if (--dq->dq_cnt > 0)
{
DQH_UNLOCK();
@ -1658,6 +1660,7 @@ quotaref(vp, qrp)
*/
found = 0;
ip = VTOI(vp);
mtx_lock(&dqhlock);
for (i = 0; i < MAXQUOTAS; i++) {
if ((dq = ip->i_dquot[i]) == NODQUOT)
continue;
@ -1665,6 +1668,7 @@ quotaref(vp, qrp)
qrp[i] = dq;
found++;
}
mtx_unlock(&dqhlock);
return (found);
}