Skip site navigation (1)Skip section navigation (2) 
Date:      Fri, 27 Dec 2013 17:09:59 +0000 (UTC)
From:      Konstantin Belousov <kib@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org
Subject:   svn commit: r259953 - head/sys/kern
Message-ID:  <201312271709.rBRH9xoU028397@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help 
Author: kib
Date: Fri Dec 27 17:09:59 2013
New Revision: 259953
URL: http://svnweb.freebsd.org/changeset/base/259953

Log:
  Fix accounting for the negative cache entries when reusing v_cache_dd.
  Having ncneg diverge with the actual length of the ncneg tailq causes
  NULL dereference.
  
  Add assertion that an entry taken from ncneg queue is indeed negative.
  
  Reported by and discussed with:	avg
  Sponsored by:	The FreeBSD Foundation
  MFC after:	1 week

Modified:
  head/sys/kern/vfs_cache.c

Modified: head/sys/kern/vfs_cache.c
==============================================================================
--- head/sys/kern/vfs_cache.c	Fri Dec 27 17:04:51 2013	(r259952)
+++ head/sys/kern/vfs_cache.c	Fri Dec 27 17:09:59 2013	(r259953)
@@ -748,16 +748,20 @@ cache_enter_time(dvp, vp, cnp, tsp, dtsp
 			    ncp->nc_flag & NCF_ISDOTDOT) {
 				KASSERT(ncp->nc_dvp == dvp,
 				    ("wrong isdotdot parent"));
-				if (ncp->nc_vp != NULL)
+				if (ncp->nc_vp != NULL) {
 					TAILQ_REMOVE(&ncp->nc_vp->v_cache_dst,
 					    ncp, nc_dst);
-				else
+				} else {
 					TAILQ_REMOVE(&ncneg, ncp, nc_dst);
-				if (vp != NULL)
+					numneg--;
+				}
+				if (vp != NULL) {
 					TAILQ_INSERT_HEAD(&vp->v_cache_dst,
 					    ncp, nc_dst);
-				else
+				} else {
 					TAILQ_INSERT_TAIL(&ncneg, ncp, nc_dst);
+					numneg++;
+				}
 				ncp->nc_vp = vp;
 				CACHE_WUNLOCK();
 				return;
@@ -893,6 +897,8 @@ cache_enter_time(dvp, vp, cnp, tsp, dtsp
 	}
 	if (numneg * ncnegfactor > numcache) {
 		ncp = TAILQ_FIRST(&ncneg);
+		KASSERT(ncp->nc_vp == NULL, ("ncp %p vp %p on ncneg",
+		    ncp, ncp->nc_vp));
 		zap = 1;
 	}
 	if (hold)

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201312271709.rBRH9xoU028397>