Skip site navigation (1)Skip section navigation (2)
Date:      Sat, 21 Apr 2012 10:45:46 +0000 (UTC)
From:      Edward Tomasz Napierala <trasz@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org
Subject:   svn commit: r234537 - head/sys/ufs/ffs
Message-ID:  <201204211045.q3LAjkPO083349@svn.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: trasz
Date: Sat Apr 21 10:45:46 2012
New Revision: 234537
URL: http://svn.freebsd.org/changeset/base/234537

Log:
  Fix use-after-free introduced in r234036.
  
  Reviewed by:	mckusick
  Tested by:	pho

Modified:
  head/sys/ufs/ffs/ffs_vfsops.c

Modified: head/sys/ufs/ffs/ffs_vfsops.c
==============================================================================
--- head/sys/ufs/ffs/ffs_vfsops.c	Sat Apr 21 07:31:27 2012	(r234536)
+++ head/sys/ufs/ffs/ffs_vfsops.c	Sat Apr 21 10:45:46 2012	(r234537)
@@ -699,10 +699,14 @@ ffs_reload(struct mount *mp, struct thre
 	 * We no longer know anything about clusters per cylinder group.
 	 */
 	if (fs->fs_contigsumsize > 0) {
-		lp = fs->fs_maxcluster;
+		fs->fs_maxcluster = lp = space;
 		for (i = 0; i < fs->fs_ncg; i++)
 			*lp++ = fs->fs_contigsumsize;
+		space = lp;
 	}
+	size = fs->fs_ncg * sizeof(u_int8_t);
+	fs->fs_contigdirs = (u_int8_t *)space;
+	bzero(fs->fs_contigdirs, size);
 
 loop:
 	MNT_VNODE_FOREACH_ALL(vp, mp, mvp) {



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201204211045.q3LAjkPO083349>