Don Lewis 12d360453c Close a race in the ufs_lookup() code that handles the ISDOTDOT ... case by saving the value of dp->i_ino before unlocking the vnode for the current directory and passing the saved value to VFS_VGET(). Without this change, another thread can overwrite dp->i_ino after the current directory is unlocked, causing ufs_lookup() to lock and return the wrong vnode in place of the vnode for its parent directory. A deadlock can occur if dp->i_ino was changed to a subdirectory of the current directory because the root to leaf vnode lock ordering will be violated. A vnode lock can be leaked if dp->i_ino was changed to point to the current directory, which causes the current vnode lock for the current directory to be recursed, which confuses lookup() into calling vrele() when it should be calling vput(). The probability of this bug being triggered seems to be quite low unless the sysctl variable debug.vfscache is set to 0. Reviewed by: jhb MFC after: 2 weeks		2005-10-14 22:13:33 +00:00
..
ffs	Avoid unintended VMIO on directories and symlinks due to leftover object	2005-10-10 19:02:04 +00:00
ufs	Close a race in the ufs_lookup() code that handles the ISDOTDOT	2005-10-14 22:13:33 +00:00