mirror/freebsd
1
0
Fork 0
mirror of https://git.FreeBSD.org/src.git synced 2024-12-24 11:29:10 +00:00
Code Issues Releases Activity

Don't pass pointer to name buffer which is on the stack to another thread,

Browse Source 
because the stack might be paged out once the other thread tries to use the
data. Instead, just allocate memory.

MFC after:	2 weeks
This commit is contained in:
Pawel Jakub Dawidek 2011-05-24 20:10:12 +00:00
parent 541c60d988
commit b5a060dd8b
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=222268
1 changed files with 11 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_dir.c
View File

@ -239,15 +239,20 @@ zfs_dirent_lock(zfs_dirlock_t **dlpp, znode_t *dzp, char *name, znode_t **zpp,
return (ENOENT);
}
if (dl == NULL) {
size_t namesize;
/*
* Allocate a new dirlock and add it to the list.
*/
dl = kmem_alloc(sizeof (zfs_dirlock_t), KM_SLEEP);
namesize = strlen(name) + 1;
dl = kmem_alloc(sizeof (zfs_dirlock_t) + namesize,
KM_SLEEP);
cv_init(&dl->dl_cv, NULL, CV_DEFAULT, NULL);
dl->dl_name = name;
dl->dl_name = (char *)(dl + 1);
bcopy(name, dl->dl_name, namesize);
dl->dl_sharecnt = 0;
dl->dl_namelock = 0;
dl->dl_namesize = 0;
dl->dl_namesize = namesize;
dl->dl_dzp = dzp;
dl->dl_next = dzp->z_dirlocks;
dzp->z_dirlocks = dl;
@ -264,20 +269,8 @@ zfs_dirent_lock(zfs_dirlock_t **dlpp, znode_t *dzp, char *name, znode_t **zpp,
if (flag & ZHAVELOCK)
dl->dl_namelock = 1;
if ((flag & ZSHARED) && ++dl->dl_sharecnt > 1 && dl->dl_namesize == 0) {
/*
* We're the second shared reference to dl. Make a copy of
* dl_name in case the first thread goes away before we do.
* Note that we initialize the new name before storing its
* pointer into dl_name, because the first thread may load
* dl->dl_name at any time. He'll either see the old value,
* which is his, or the new shared copy; either is OK.
*/
dl->dl_namesize = strlen(dl->dl_name) + 1;
name = kmem_alloc(dl->dl_namesize, KM_SLEEP);
bcopy(dl->dl_name, name, dl->dl_namesize);
dl->dl_name = name;
}
if (flag & ZSHARED)
dl->dl_sharecnt++;
mutex_exit(&dzp->z_lock);
@ -361,10 +354,8 @@ zfs_dirent_unlock(zfs_dirlock_t *dl)
cv_broadcast(&dl->dl_cv);
mutex_exit(&dzp->z_lock);
if (dl->dl_namesize != 0)
kmem_free(dl->dl_name, dl->dl_namesize);
cv_destroy(&dl->dl_cv);
kmem_free(dl, sizeof (*dl));
kmem_free(dl, sizeof (*dl) + dl->dl_namesize);
}
/*