From owner-freebsd-bugs  Sat Apr 12 00:20:05 1997
Return-Path: <owner-bugs>
Received: (from root@localhost)
          by freefall.freebsd.org (8.8.5/8.8.5) id AAA18915
          for bugs-outgoing; Sat, 12 Apr 1997 00:20:05 -0700 (PDT)
Received: (from gnats@localhost)
          by freefall.freebsd.org (8.8.5/8.8.5) id AAA18898;
          Sat, 12 Apr 1997 00:20:02 -0700 (PDT)
Resent-Date: Sat, 12 Apr 1997 00:20:02 -0700 (PDT)
Resent-Message-Id: <199704120720.AAA18898@freefall.freebsd.org>
Resent-From: gnats (GNATS Management)
Resent-To: freebsd-bugs
Resent-Reply-To: FreeBSD-gnats@freefall.FreeBSD.org,
        kato@eclogite.eps.nagoya-u.ac.jp
Received: from marble.eps.nagoya-u.ac.jp (marble.eps.nagoya-u.ac.jp [133.6.57.68])
          by freefall.freebsd.org (8.8.5/8.8.5) with ESMTP id AAA18601
          for <FreeBSD-gnats-submit@freebsd.org>; Sat, 12 Apr 1997 00:14:43 -0700 (PDT)
Received: (from kato@localhost) by marble.eps.nagoya-u.ac.jp (8.8.5/3.4W4) id QAA03968; Sat, 12 Apr 1997 16:14:37 +0900 (JST)
Message-Id: <199704120714.QAA03968@marble.eps.nagoya-u.ac.jp>
Date: Sat, 12 Apr 1997 16:14:37 +0900 (JST)
From: kato@eclogite.eps.nagoya-u.ac.jp
Reply-To: kato@eclogite.eps.nagoya-u.ac.jp
To: FreeBSD-gnats-submit@freebsd.org
X-Send-Pr-Version: 3.2
Subject: kern/3262: memory leak of pathname buffer
Sender: owner-bugs@freebsd.org
X-Loop: FreeBSD.org
Precedence: bulk


>Number:         3262
>Category:       kern
>Synopsis:       memory leak in union_relookup
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    freebsd-bugs
>State:          open
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sat Apr 12 00:20:01 PDT 1997
>Last-Modified:
>Originator:     KATO Takenori
>Organization:
Dept. Earth Planet. Sci, Nagoya Univ.
>Release:        FreeBSD 3.0-CURRENT i386
>Environment:

	

>Description:

The path name buffer, cn->cn_pnbuf, is FREEed by VOP_MKDIR when
relookup() in union_relookup() is succeeded.  However, if relookup()
returns non-zero value, that is relookup fails, VOP_MKDIR is never
called (c.f. union_mkshadow).  Thus, pathname buffer is never FREEed.

>How-To-Repeat:

	

>Fix:
	
---------- BEGIN ----------
*** union_subr.c.ORIG	Sat Apr 12 16:03:51 1997
--- union_subr.c	Sat Apr 12 16:04:57 1997
***************
*** 752,757 ****
--- 752,761 ----
  	error = relookup(dvp, vpp, cn);
  	if (!error)
  		vrele(dvp);
+ 	else {
+ 		free(cn->cn_pnbuf, M_NAMEI);
+ 		cn->cn_pnbuf = '\0';
+ 	}
  
  	return (error);
  }
---------- END ----------

>Audit-Trail:
>Unformatted: