mirror/freebsd
1
0
Fork 0
mirror of https://git.FreeBSD.org/src.git synced 2024-12-17 10:26:15 +00:00
Code Issues Releases Activity

Make sure to grab vnode lock on a vnode before calling VOP_GETATTR()

Browse Source 
to perform an ownership test in revoke().  This is also required for
MAC hooks so that the vnode lock is held during a call to the MAC
framework.  Release the lock before calling VOP_REVOKE().

Discussed with:	phk, mckusick
This commit is contained in:
Robert Watson 2002-02-10 20:45:43 +00:00
parent 535cc97895
commit c0a9dc83c8
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=90480
2 changed files with 18 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
sys/kern/vfs_extattr.c
View File

@ -3525,18 +3525,22 @@ revoke(td, uap)
int error;
struct nameidata nd;
NDINIT(&nd, LOOKUP, FOLLOW, UIO_USERSPACE, SCARG(uap, path), td);
NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_USERSPACE, SCARG(uap, path),
td);
if ((error = namei(&nd)) != 0)
return (error);
vp = nd.ni_vp;
NDFREE(&nd, NDF_ONLY_PNBUF);
if (vp->v_type != VCHR) {
error = EINVAL;
goto out;
vput(vp);
return (EINVAL);
}
error = VOP_GETATTR(vp, &vattr, td->td_proc->p_ucred, td);
if (error)
goto out;
if (error) {
vput(vp);
return (error);
}
VOP_UNLOCK(vp, 0, td);
if (td->td_proc->p_ucred->cr_uid != vattr.va_uid) {
error = suser_xxx(0, td->td_proc, PRISON_ROOT);
if (error)

14
sys/kern/vfs_syscalls.c
View File

@ -3525,18 +3525,22 @@ revoke(td, uap)
int error;
struct nameidata nd;
NDINIT(&nd, LOOKUP, FOLLOW, UIO_USERSPACE, SCARG(uap, path), td);
NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_USERSPACE, SCARG(uap, path),
td);
if ((error = namei(&nd)) != 0)
return (error);
vp = nd.ni_vp;
NDFREE(&nd, NDF_ONLY_PNBUF);
if (vp->v_type != VCHR) {
error = EINVAL;
goto out;
vput(vp);
return (EINVAL);
}
error = VOP_GETATTR(vp, &vattr, td->td_proc->p_ucred, td);
if (error)
goto out;
if (error) {
vput(vp);
return (error);
}
VOP_UNLOCK(vp, 0, td);
if (td->td_proc->p_ucred->cr_uid != vattr.va_uid) {
error = suser_xxx(0, td->td_proc, PRISON_ROOT);
if (error)