From owner-svn-src-all@FreeBSD.ORG  Sat Jun 23 18:26:24 2012
Return-Path: <owner-svn-src-all@FreeBSD.ORG>
Delivered-To: svn-src-all@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
	by hub.freebsd.org (Postfix) with ESMTP id 7DDDB106566B;
	Sat, 23 Jun 2012 18:26:24 +0000 (UTC)
	(envelope-from trasz@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c])
	by mx1.freebsd.org (Postfix) with ESMTP id 683508FC08;
	Sat, 23 Jun 2012 18:26:24 +0000 (UTC)
Received: from svn.freebsd.org (localhost [127.0.0.1])
	by svn.freebsd.org (8.14.4/8.14.4) with ESMTP id q5NIQOEY056915;
	Sat, 23 Jun 2012 18:26:24 GMT (envelope-from trasz@svn.freebsd.org)
Received: (from trasz@localhost)
	by svn.freebsd.org (8.14.4/8.14.4/Submit) id q5NIQOgY056913;
	Sat, 23 Jun 2012 18:26:24 GMT (envelope-from trasz@svn.freebsd.org)
Message-Id: <201206231826.q5NIQOgY056913@svn.freebsd.org>
From: Edward Tomasz Napierala <trasz@FreeBSD.org>
Date: Sat, 23 Jun 2012 18:26:24 +0000 (UTC)
To: src-committers@freebsd.org, svn-src-all@freebsd.org,
	svn-src-stable@freebsd.org, svn-src-stable-9@freebsd.org
X-SVN-Group: stable-9
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Cc: 
Subject: svn commit: r237490 - stable/9/sys/ufs/ffs
X-BeenThere: svn-src-all@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "SVN commit messages for the entire src tree \(except for &quot;
	user&quot; and &quot; projects&quot; \)" <svn-src-all.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/svn-src-all>,
	<mailto:svn-src-all-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-src-all>
List-Post: <mailto:svn-src-all@freebsd.org>
List-Help: <mailto:svn-src-all-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/svn-src-all>,
	<mailto:svn-src-all-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sat, 23 Jun 2012 18:26:24 -0000

Author: trasz
Date: Sat Jun 23 18:26:23 2012
New Revision: 237490
URL: http://svn.freebsd.org/changeset/base/237490

Log:
  MFC r234036:
  
  Fix panic in ffs_reload(), which may happen when read-only filesystem
  gets resized and then reloaded.
  
  MFC r234537:
  
  Fix use-after-free introduced in r234036.

Modified:
  stable/9/sys/ufs/ffs/ffs_vfsops.c
Directory Properties:
  stable/9/sys/   (props changed)

Modified: stable/9/sys/ufs/ffs/ffs_vfsops.c
==============================================================================
--- stable/9/sys/ufs/ffs/ffs_vfsops.c	Sat Jun 23 18:07:48 2012	(r237489)
+++ stable/9/sys/ufs/ffs/ffs_vfsops.c	Sat Jun 23 18:26:23 2012	(r237490)
@@ -675,8 +675,14 @@ ffs_reload(struct mount *mp, struct thre
 	/*
 	 * Step 3: re-read summary information from disk.
 	 */
-	blks = howmany(fs->fs_cssize, fs->fs_fsize);
-	space = fs->fs_csp;
+	size = fs->fs_cssize;
+	blks = howmany(size, fs->fs_fsize);
+	if (fs->fs_contigsumsize > 0)
+		size += fs->fs_ncg * sizeof(int32_t);
+	size += fs->fs_ncg * sizeof(u_int8_t);
+	free(fs->fs_csp, M_UFSMNT);
+	space = malloc((u_long)size, M_UFSMNT, M_WAITOK);
+	fs->fs_csp = space;
 	for (i = 0; i < blks; i += fs->fs_frag) {
 		size = fs->fs_bsize;
 		if (i + fs->fs_frag > blks)
@@ -693,10 +699,14 @@ ffs_reload(struct mount *mp, struct thre
 	 * We no longer know anything about clusters per cylinder group.
 	 */
 	if (fs->fs_contigsumsize > 0) {
-		lp = fs->fs_maxcluster;
+		fs->fs_maxcluster = lp = space;
 		for (i = 0; i < fs->fs_ncg; i++)
 			*lp++ = fs->fs_contigsumsize;
+		space = lp;
 	}
+	size = fs->fs_ncg * sizeof(u_int8_t);
+	fs->fs_contigdirs = (u_int8_t *)space;
+	bzero(fs->fs_contigdirs, size);
 
 loop:
 	MNT_VNODE_FOREACH_ALL(vp, mp, mvp) {