From owner-cvs-src@FreeBSD.ORG  Fri Oct 14 22:13:33 2005
Return-Path: <owner-cvs-src@FreeBSD.ORG>
X-Original-To: cvs-src@FreeBSD.org
Delivered-To: cvs-src@FreeBSD.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id E707A16A43A;
	Fri, 14 Oct 2005 22:13:33 +0000 (GMT)
	(envelope-from truckman@FreeBSD.org)
Received: from repoman.freebsd.org (repoman.freebsd.org [216.136.204.115])
	by mx1.FreeBSD.org (Postfix) with ESMTP id BA77A43D45;
	Fri, 14 Oct 2005 22:13:33 +0000 (GMT)
	(envelope-from truckman@FreeBSD.org)
Received: from repoman.freebsd.org (localhost [127.0.0.1])
	by repoman.freebsd.org (8.13.1/8.13.1) with ESMTP id j9EMDX6T092685;
	Fri, 14 Oct 2005 22:13:33 GMT
	(envelope-from truckman@repoman.freebsd.org)
Received: (from truckman@localhost)
	by repoman.freebsd.org (8.13.1/8.13.1/Submit) id j9EMDX8Q092684;
	Fri, 14 Oct 2005 22:13:33 GMT (envelope-from truckman)
Message-Id: <200510142213.j9EMDX8Q092684@repoman.freebsd.org>
From: Don Lewis <truckman@FreeBSD.org>
Date: Fri, 14 Oct 2005 22:13:33 +0000 (UTC)
To: src-committers@FreeBSD.org, cvs-src@FreeBSD.org, cvs-all@FreeBSD.org
X-FreeBSD-CVS-Branch: HEAD
Cc: 
Subject: cvs commit: src/sys/ufs/ufs ufs_lookup.c
X-BeenThere: cvs-src@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: CVS commit messages for the src tree <cvs-src.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/cvs-src>,
	<mailto:cvs-src-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/cvs-src>
List-Post: <mailto:cvs-src@freebsd.org>
List-Help: <mailto:cvs-src-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/cvs-src>,
	<mailto:cvs-src-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 14 Oct 2005 22:13:34 -0000

truckman    2005-10-14 22:13:33 UTC

  FreeBSD src repository

  Modified files:
    sys/ufs/ufs          ufs_lookup.c 
  Log:
  Close a race in the ufs_lookup() code that handles the ISDOTDOT
  case by saving the value of dp->i_ino before unlocking the vnode
  for the current directory and passing the saved value to VFS_VGET().
  
  Without this change, another thread can overwrite dp->i_ino after
  the current directory is unlocked, causing  ufs_lookup() to lock
  and return the wrong vnode in place of the vnode for its parent
  directory.  A deadlock can occur if dp->i_ino was changed to a
  subdirectory of the current directory because the root to leaf vnode
  lock ordering will be violated.  A vnode lock can be leaked if
  dp->i_ino was changed to point to the current directory, which
  causes the current vnode lock for the current directory to be
  recursed, which confuses lookup() into calling vrele() when it
  should be calling vput().
  
  The probability of this bug being triggered seems to be quite low
  unless the sysctl variable debug.vfscache is set to 0.
  
  Reviewed by:    jhb
  MFC after:      2 weeks
  
  Revision  Changes    Path
  1.78      +3 -1      src/sys/ufs/ufs/ufs_lookup.c