7 files changed, 80 insertions, 32 deletions

diff --git a/sys/miscfs/fdesc/fdesc_vnops.c b/sys/miscfs/fdesc/fdesc_vnops.c
index a2f64130b5f9..21f56778d2f6 100644
--- a/sys/miscfs/fdesc/fdesc_vnops.c
+++ b/sys/miscfs/fdesc/fdesc_vnops.c
@@ -35,7 +35,7 @@
  *
  *	@(#)fdesc_vnops.c	8.9 (Berkeley) 1/21/94
  *
- * $Id: fdesc_vnops.c,v 1.10 1995/09/02 20:19:12 mpp Exp $
+ * $Id: fdesc_vnops.c,v 1.9.4.1 1995/09/12 08:48:26 davidg Exp $
  */
 
 /*
@@ -146,10 +146,18 @@ loop:
 	}
 	fdcache_lock |= FDL_LOCKED;
 
+	/*
+	 * Do the MALLOC before the getnewvnode since doing so afterward
+	 * might cause a bogus v_data pointer to get dereferenced
+	 * elsewhere if MALLOC should block.
+	 */
+	MALLOC(fd, struct fdescnode *, sizeof(struct fdescnode), M_TEMP, M_WAITOK);
+
 	error = getnewvnode(VT_FDESC, mp, fdesc_vnodeop_p, vpp);
-	if (error)
+	if (error) {
+		FREE(fd, M_TEMP);
 		goto out;
-	MALLOC(fd, void *, sizeof(struct fdescnode), M_TEMP, M_WAITOK);
+	}
 	(*vpp)->v_data = fd;
 	fd->fd_vnode = *vpp;
 	fd->fd_type = ftype;
diff --git a/sys/miscfs/kernfs/kernfs_vfsops.c b/sys/miscfs/kernfs/kernfs_vfsops.c
index e6f97c700f91..38760a11f399 100644
--- a/sys/miscfs/kernfs/kernfs_vfsops.c
+++ b/sys/miscfs/kernfs/kernfs_vfsops.c
@@ -34,7 +34,7 @@
  * SUCH DAMAGE.
  *
  *	@(#)kernfs_vfsops.c	8.4 (Berkeley) 1/21/94
- * $Id: kernfs_vfsops.c,v 1.8 1995/03/16 20:23:38 wollman Exp $
+ * $Id: kernfs_vfsops.c,v 1.9 1995/05/25 01:35:15 davidg Exp $
  */
 
 /*
@@ -142,12 +142,15 @@ kernfs_mount(mp, path, data, ndp, p)
 	if (mp->mnt_flag & MNT_UPDATE)
 		return (EOPNOTSUPP);
 
+	MALLOC(fmp, struct kernfs_mount *, sizeof(struct kernfs_mount),
+				M_UFSMNT, M_WAITOK);	/* XXX */
+
 	error = getnewvnode(VT_KERNFS, mp, kernfs_vnodeop_p, &rvp);	/* XXX */
-	if (error)
+	if (error) {
+		FREE(fmp, M_UFSMNT);
 		return (error);
+	}
 
-	MALLOC(fmp, struct kernfs_mount *, sizeof(struct kernfs_mount),
-				M_UFSMNT, M_WAITOK);	/* XXX */
 	rvp->v_type = VDIR;
 	rvp->v_flag |= VROOT;
 #ifdef KERNFS_DIAGNOSTIC
diff --git a/sys/miscfs/nullfs/null_subr.c b/sys/miscfs/nullfs/null_subr.c
index 8d18ffdc9e71..181145811c78 100644
--- a/sys/miscfs/nullfs/null_subr.c
+++ b/sys/miscfs/nullfs/null_subr.c
@@ -35,7 +35,7 @@
  *
  *	@(#)null_subr.c	8.4 (Berkeley) 1/21/94
  *
- * $Id: null_subr.c,v 1.2 1994/05/25 09:08:00 rgrimes Exp $
+ * $Id: null_subr.c,v 1.3 1994/10/02 17:48:14 phk Exp $
  */
 
 #include <sys/param.h>
@@ -153,12 +153,20 @@ null_node_alloc(mp, lowervp, vpp)
 	struct vnode *othervp, *vp;
 	int error;
 
+	/*
+	 * Do the MALLOC before the getnewvnode since doing so afterward
+	 * might cause a bogus v_data pointer to get dereferenced
+	 * elsewhere if MALLOC should block.
+	 */
+	MALLOC(xp, struct null_node *, sizeof(struct null_node), M_TEMP, M_WAITOK);
+
 	error = getnewvnode(VT_NULL, mp, null_vnodeop_p, vpp);
-	if (error)
+	if (error) {
+		FREE(xp, M_TEMP);
 		return (error);
+	}
 	vp = *vpp;
 
-	MALLOC(xp, struct null_node *, sizeof(struct null_node), M_TEMP, M_WAITOK);
 	vp->v_type = lowervp->v_type;
 	xp->null_vnode = vp;
 	vp->v_data = xp;
diff --git a/sys/miscfs/portal/portal_vfsops.c b/sys/miscfs/portal/portal_vfsops.c
index 52c7bcf6094e..46161e564884 100644
--- a/sys/miscfs/portal/portal_vfsops.c
+++ b/sys/miscfs/portal/portal_vfsops.c
@@ -35,7 +35,7 @@
  *
  *	@(#)portal_vfsops.c	8.6 (Berkeley) 1/21/94
  *
- * $Id: portal_vfsops.c,v 1.7 1995/03/16 20:23:41 wollman Exp $
+ * $Id: portal_vfsops.c,v 1.8 1995/05/30 08:07:05 rgrimes Exp $
  */
 
 /*
@@ -85,6 +85,7 @@ portal_mount(mp, path, data, ndp, p)
 	struct portalmount *fmp;
 	struct socket *so;
 	struct vnode *rvp;
+	struct portalnode *pn;
 	u_int size;
 	int error;
 
@@ -105,14 +106,20 @@ portal_mount(mp, path, data, ndp, p)
 	if (so->so_proto->pr_domain->dom_family != AF_UNIX)
 		return (ESOCKTNOSUPPORT);
 
+	MALLOC(pn, struct portalnode *, sizeof(struct portalnode),
+		M_TEMP, M_WAITOK);
+
+	MALLOC(fmp, struct portalmount *, sizeof(struct portalmount),
+		M_UFSMNT, M_WAITOK);	/* XXX */
+
 	error = getnewvnode(VT_PORTAL, mp, portal_vnodeop_p, &rvp); /* XXX */
-	if (error)
+	if (error) {
+		FREE(fmp, M_UFSMNT);
+		FREE(pn, M_TEMP);
 		return (error);
-	MALLOC(rvp->v_data, void *, sizeof(struct portalnode),
-		M_TEMP, M_WAITOK);
+	}
 
-	fmp = (struct portalmount *) malloc(sizeof(struct portalmount),
-				 M_UFSMNT, M_WAITOK);	/* XXX */
+	rvp->v_data = pn;
 	rvp->v_type = VDIR;
 	rvp->v_flag |= VROOT;
 	VTOPORTAL(rvp)->pt_arg = 0;
diff --git a/sys/miscfs/portal/portal_vnops.c b/sys/miscfs/portal/portal_vnops.c
index 41fd2de3f416..8782e741e868 100644
--- a/sys/miscfs/portal/portal_vnops.c
+++ b/sys/miscfs/portal/portal_vnops.c
@@ -35,7 +35,7 @@
  *
  *	@(#)portal_vnops.c	8.8 (Berkeley) 1/21/94
  *
- * $Id: portal_vnops.c,v 1.5 1995/03/28 07:57:02 bde Exp $
+ * $Id: portal_vnops.c,v 1.6 1995/05/30 08:07:06 rgrimes Exp $
  */
 
 /*
@@ -109,15 +109,21 @@ portal_lookup(ap)
 		return (0);
 	}
 
+	/*
+	 * Do the MALLOC before the getnewvnode since doing so afterward
+	 * might cause a bogus v_data pointer to get dereferenced
+	 * elsewhere if MALLOC should block.
+	 */
+	MALLOC(pt, struct portalnode *, sizeof(struct portalnode),
+		M_TEMP, M_WAITOK);
 
 	error = getnewvnode(VT_PORTAL, ap->a_dvp->v_mount, portal_vnodeop_p, &fvp);
-	if (error)
+	if (error) {
+		FREE(pt, M_TEMP);
 		goto bad;
+	}
 	fvp->v_type = VREG;
-	MALLOC(fvp->v_data, void *, sizeof(struct portalnode),
-		M_TEMP, M_WAITOK);
-
-	pt = VTOPORTAL(fvp);
+	fvp->v_data = pt;
 	/*
 	 * Save all of the remaining pathname and
 	 * advance the namei next pointer to the end
diff --git a/sys/miscfs/procfs/procfs_subr.c b/sys/miscfs/procfs/procfs_subr.c
index 6c464c1bdb77..7a0eafe50afb 100644
--- a/sys/miscfs/procfs/procfs_subr.c
+++ b/sys/miscfs/procfs/procfs_subr.c
@@ -36,7 +36,7 @@
  *
  *	@(#)procfs_subr.c	8.4 (Berkeley) 1/27/94
  *
- *	$Id: procfs_subr.c,v 1.4 1995/04/15 02:30:12 davidg Exp $
+ *	$Id: procfs_subr.c,v 1.5 1995/05/30 08:07:11 rgrimes Exp $
  */
 
 #include <sys/param.h>
@@ -111,14 +111,20 @@ loop:
 	}
 	pfsvplock |= PROCFS_LOCKED;
 
+	/*
+	 * Do the MALLOC before the getnewvnode since doing so afterward
+	 * might cause a bogus v_data pointer to get dereferenced
+	 * elsewhere if MALLOC should block.
+	 */
+	MALLOC(pfs, struct pfsnode *, sizeof(struct pfsnode), M_TEMP, M_WAITOK);
+
 	error = getnewvnode(VT_PROCFS, mp, procfs_vnodeop_p, vpp);
-	if (error)
+	if (error) {
+		FREE(pfs, M_TEMP);
 		goto out;
+	}
 
-	MALLOC((*vpp)->v_data, void *, sizeof(struct pfsnode),
-		M_TEMP, M_WAITOK);
-
-	pfs = VTOPFS(*vpp);
+	(*vpp)->v_data = pfs;
 	pfs->pfs_next = 0;
 	pfs->pfs_pid = (pid_t) pid;
 	pfs->pfs_type = pfs_type;
diff --git a/sys/miscfs/umapfs/umap_subr.c b/sys/miscfs/umapfs/umap_subr.c
index 792f4a87b05e..a65a5bb03009 100644
--- a/sys/miscfs/umapfs/umap_subr.c
+++ b/sys/miscfs/umapfs/umap_subr.c
@@ -35,7 +35,7 @@
  *
  *	@(#)umap_subr.c	8.6 (Berkeley) 1/26/94
  *
- * $Id: umap_subr.c,v 1.3 1994/10/10 07:55:43 phk Exp $
+ * $Id: umap_subr.c,v 1.4 1995/05/30 08:07:17 rgrimes Exp $
  */
 
 #include <sys/param.h>
@@ -212,13 +212,23 @@ umap_node_alloc(mp, lowervp, vpp)
 	struct vnode *othervp, *vp;
 	int error;
 
+	/* XXX This routine probably needs a node_alloc lock */
+
+	/*
+	 * Do the MALLOC before the getnewvnode since doing so afterward
+	 * might cause a bogus v_data pointer to get dereferenced
+	 * elsewhere if MALLOC should block.
+	 */
+	MALLOC(xp, struct umap_node *, sizeof(struct umap_node),
+	    M_TEMP, M_WAITOK);
+
 	error = getnewvnode(VT_UMAP, mp, umap_vnodeop_p, vpp);
-	if (error)
+	if (error) {
+		FREE(xp, M_TEMP);
 		return (error);
+	}
 	vp = *vpp;
 
-	MALLOC(xp, struct umap_node *, sizeof(struct umap_node),
-	    M_TEMP, M_WAITOK);
 	vp->v_type = lowervp->v_type;
 	xp->umap_vnode = vp;
 	vp->v_data = xp;