summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--sys/isofs/cd9660/cd9660_node.c15
-rw-r--r--sys/miscfs/fdesc/fdesc_vnops.c14
-rw-r--r--sys/miscfs/kernfs/kernfs_vfsops.c11
-rw-r--r--sys/miscfs/nullfs/null_subr.c14
-rw-r--r--sys/miscfs/portal/portal_vfsops.c19
-rw-r--r--sys/miscfs/portal/portal_vnops.c18
-rw-r--r--sys/miscfs/procfs/procfs_subr.c18
-rw-r--r--sys/miscfs/umapfs/umap_subr.c18
-rw-r--r--sys/msdosfs/msdosfs_denode.c12
-rw-r--r--sys/nfs/nfs_node.c13
-rw-r--r--sys/ufs/ffs/ffs_vfsops.c15
-rw-r--r--sys/ufs/lfs/lfs_alloc.c11
-rw-r--r--sys/ufs/mfs/mfs_vfsops.c14
13 files changed, 142 insertions, 50 deletions
diff --git a/sys/isofs/cd9660/cd9660_node.c b/sys/isofs/cd9660/cd9660_node.c
index 7b321a788274..e6429b81ead1 100644
--- a/sys/isofs/cd9660/cd9660_node.c
+++ b/sys/isofs/cd9660/cd9660_node.c
@@ -36,7 +36,7 @@
* SUCH DAMAGE.
*
* @(#)cd9660_node.c 8.2 (Berkeley) 1/23/94
- * $Id: cd9660_node.c,v 1.10 1995/03/16 18:12:15 bde Exp $
+ * $Id: cd9660_node.c,v 1.11 1995/05/30 08:04:59 rgrimes Exp $
*/
#include <sys/param.h>
@@ -202,15 +202,22 @@ loop:
*ipp = ip;
return 0;
}
+
+ /*
+ * Do the MALLOC before the getnewvnode since doing so afterward
+ * might cause a bogus v_data pointer to get dereferenced
+ * elsewhere if MALLOC should block.
+ */
+ MALLOC(ip, struct iso_node *, sizeof(struct iso_node), M_ISOFSNODE, M_WAITOK);
+
/*
* Allocate a new vnode/iso_node.
*/
if ((error = getnewvnode(VT_ISOFS, mntp, cd9660_vnodeop_p, &nvp))) {
- *ipp = 0;
+ *ipp = NULL;
+ FREE(ip, M_ISOFSNODE);
return error;
}
- MALLOC(ip, struct iso_node *, sizeof(struct iso_node),
- M_ISOFSNODE, M_WAITOK);
bzero((caddr_t)ip, sizeof(struct iso_node));
nvp->v_data = ip;
ip->i_vnode = nvp;
diff --git a/sys/miscfs/fdesc/fdesc_vnops.c b/sys/miscfs/fdesc/fdesc_vnops.c
index a2f64130b5f9..21f56778d2f6 100644
--- a/sys/miscfs/fdesc/fdesc_vnops.c
+++ b/sys/miscfs/fdesc/fdesc_vnops.c
@@ -35,7 +35,7 @@
*
* @(#)fdesc_vnops.c 8.9 (Berkeley) 1/21/94
*
- * $Id: fdesc_vnops.c,v 1.10 1995/09/02 20:19:12 mpp Exp $
+ * $Id: fdesc_vnops.c,v 1.9.4.1 1995/09/12 08:48:26 davidg Exp $
*/
/*
@@ -146,10 +146,18 @@ loop:
}
fdcache_lock |= FDL_LOCKED;
+ /*
+ * Do the MALLOC before the getnewvnode since doing so afterward
+ * might cause a bogus v_data pointer to get dereferenced
+ * elsewhere if MALLOC should block.
+ */
+ MALLOC(fd, struct fdescnode *, sizeof(struct fdescnode), M_TEMP, M_WAITOK);
+
error = getnewvnode(VT_FDESC, mp, fdesc_vnodeop_p, vpp);
- if (error)
+ if (error) {
+ FREE(fd, M_TEMP);
goto out;
- MALLOC(fd, void *, sizeof(struct fdescnode), M_TEMP, M_WAITOK);
+ }
(*vpp)->v_data = fd;
fd->fd_vnode = *vpp;
fd->fd_type = ftype;
diff --git a/sys/miscfs/kernfs/kernfs_vfsops.c b/sys/miscfs/kernfs/kernfs_vfsops.c
index e6f97c700f91..38760a11f399 100644
--- a/sys/miscfs/kernfs/kernfs_vfsops.c
+++ b/sys/miscfs/kernfs/kernfs_vfsops.c
@@ -34,7 +34,7 @@
* SUCH DAMAGE.
*
* @(#)kernfs_vfsops.c 8.4 (Berkeley) 1/21/94
- * $Id: kernfs_vfsops.c,v 1.8 1995/03/16 20:23:38 wollman Exp $
+ * $Id: kernfs_vfsops.c,v 1.9 1995/05/25 01:35:15 davidg Exp $
*/
/*
@@ -142,12 +142,15 @@ kernfs_mount(mp, path, data, ndp, p)
if (mp->mnt_flag & MNT_UPDATE)
return (EOPNOTSUPP);
+ MALLOC(fmp, struct kernfs_mount *, sizeof(struct kernfs_mount),
+ M_UFSMNT, M_WAITOK); /* XXX */
+
error = getnewvnode(VT_KERNFS, mp, kernfs_vnodeop_p, &rvp); /* XXX */
- if (error)
+ if (error) {
+ FREE(fmp, M_UFSMNT);
return (error);
+ }
- MALLOC(fmp, struct kernfs_mount *, sizeof(struct kernfs_mount),
- M_UFSMNT, M_WAITOK); /* XXX */
rvp->v_type = VDIR;
rvp->v_flag |= VROOT;
#ifdef KERNFS_DIAGNOSTIC
diff --git a/sys/miscfs/nullfs/null_subr.c b/sys/miscfs/nullfs/null_subr.c
index 8d18ffdc9e71..181145811c78 100644
--- a/sys/miscfs/nullfs/null_subr.c
+++ b/sys/miscfs/nullfs/null_subr.c
@@ -35,7 +35,7 @@
*
* @(#)null_subr.c 8.4 (Berkeley) 1/21/94
*
- * $Id: null_subr.c,v 1.2 1994/05/25 09:08:00 rgrimes Exp $
+ * $Id: null_subr.c,v 1.3 1994/10/02 17:48:14 phk Exp $
*/
#include <sys/param.h>
@@ -153,12 +153,20 @@ null_node_alloc(mp, lowervp, vpp)
struct vnode *othervp, *vp;
int error;
+ /*
+ * Do the MALLOC before the getnewvnode since doing so afterward
+ * might cause a bogus v_data pointer to get dereferenced
+ * elsewhere if MALLOC should block.
+ */
+ MALLOC(xp, struct null_node *, sizeof(struct null_node), M_TEMP, M_WAITOK);
+
error = getnewvnode(VT_NULL, mp, null_vnodeop_p, vpp);
- if (error)
+ if (error) {
+ FREE(xp, M_TEMP);
return (error);
+ }
vp = *vpp;
- MALLOC(xp, struct null_node *, sizeof(struct null_node), M_TEMP, M_WAITOK);
vp->v_type = lowervp->v_type;
xp->null_vnode = vp;
vp->v_data = xp;
diff --git a/sys/miscfs/portal/portal_vfsops.c b/sys/miscfs/portal/portal_vfsops.c
index 52c7bcf6094e..46161e564884 100644
--- a/sys/miscfs/portal/portal_vfsops.c
+++ b/sys/miscfs/portal/portal_vfsops.c
@@ -35,7 +35,7 @@
*
* @(#)portal_vfsops.c 8.6 (Berkeley) 1/21/94
*
- * $Id: portal_vfsops.c,v 1.7 1995/03/16 20:23:41 wollman Exp $
+ * $Id: portal_vfsops.c,v 1.8 1995/05/30 08:07:05 rgrimes Exp $
*/
/*
@@ -85,6 +85,7 @@ portal_mount(mp, path, data, ndp, p)
struct portalmount *fmp;
struct socket *so;
struct vnode *rvp;
+ struct portalnode *pn;
u_int size;
int error;
@@ -105,14 +106,20 @@ portal_mount(mp, path, data, ndp, p)
if (so->so_proto->pr_domain->dom_family != AF_UNIX)
return (ESOCKTNOSUPPORT);
+ MALLOC(pn, struct portalnode *, sizeof(struct portalnode),
+ M_TEMP, M_WAITOK);
+
+ MALLOC(fmp, struct portalmount *, sizeof(struct portalmount),
+ M_UFSMNT, M_WAITOK); /* XXX */
+
error = getnewvnode(VT_PORTAL, mp, portal_vnodeop_p, &rvp); /* XXX */
- if (error)
+ if (error) {
+ FREE(fmp, M_UFSMNT);
+ FREE(pn, M_TEMP);
return (error);
- MALLOC(rvp->v_data, void *, sizeof(struct portalnode),
- M_TEMP, M_WAITOK);
+ }
- fmp = (struct portalmount *) malloc(sizeof(struct portalmount),
- M_UFSMNT, M_WAITOK); /* XXX */
+ rvp->v_data = pn;
rvp->v_type = VDIR;
rvp->v_flag |= VROOT;
VTOPORTAL(rvp)->pt_arg = 0;
diff --git a/sys/miscfs/portal/portal_vnops.c b/sys/miscfs/portal/portal_vnops.c
index 41fd2de3f416..8782e741e868 100644
--- a/sys/miscfs/portal/portal_vnops.c
+++ b/sys/miscfs/portal/portal_vnops.c
@@ -35,7 +35,7 @@
*
* @(#)portal_vnops.c 8.8 (Berkeley) 1/21/94
*
- * $Id: portal_vnops.c,v 1.5 1995/03/28 07:57:02 bde Exp $
+ * $Id: portal_vnops.c,v 1.6 1995/05/30 08:07:06 rgrimes Exp $
*/
/*
@@ -109,15 +109,21 @@ portal_lookup(ap)
return (0);
}
+ /*
+ * Do the MALLOC before the getnewvnode since doing so afterward
+ * might cause a bogus v_data pointer to get dereferenced
+ * elsewhere if MALLOC should block.
+ */
+ MALLOC(pt, struct portalnode *, sizeof(struct portalnode),
+ M_TEMP, M_WAITOK);
error = getnewvnode(VT_PORTAL, ap->a_dvp->v_mount, portal_vnodeop_p, &fvp);
- if (error)
+ if (error) {
+ FREE(pt, M_TEMP);
goto bad;
+ }
fvp->v_type = VREG;
- MALLOC(fvp->v_data, void *, sizeof(struct portalnode),
- M_TEMP, M_WAITOK);
-
- pt = VTOPORTAL(fvp);
+ fvp->v_data = pt;
/*
* Save all of the remaining pathname and
* advance the namei next pointer to the end
diff --git a/sys/miscfs/procfs/procfs_subr.c b/sys/miscfs/procfs/procfs_subr.c
index 6c464c1bdb77..7a0eafe50afb 100644
--- a/sys/miscfs/procfs/procfs_subr.c
+++ b/sys/miscfs/procfs/procfs_subr.c
@@ -36,7 +36,7 @@
*
* @(#)procfs_subr.c 8.4 (Berkeley) 1/27/94
*
- * $Id: procfs_subr.c,v 1.4 1995/04/15 02:30:12 davidg Exp $
+ * $Id: procfs_subr.c,v 1.5 1995/05/30 08:07:11 rgrimes Exp $
*/
#include <sys/param.h>
@@ -111,14 +111,20 @@ loop:
}
pfsvplock |= PROCFS_LOCKED;
+ /*
+ * Do the MALLOC before the getnewvnode since doing so afterward
+ * might cause a bogus v_data pointer to get dereferenced
+ * elsewhere if MALLOC should block.
+ */
+ MALLOC(pfs, struct pfsnode *, sizeof(struct pfsnode), M_TEMP, M_WAITOK);
+
error = getnewvnode(VT_PROCFS, mp, procfs_vnodeop_p, vpp);
- if (error)
+ if (error) {
+ FREE(pfs, M_TEMP);
goto out;
+ }
- MALLOC((*vpp)->v_data, void *, sizeof(struct pfsnode),
- M_TEMP, M_WAITOK);
-
- pfs = VTOPFS(*vpp);
+ (*vpp)->v_data = pfs;
pfs->pfs_next = 0;
pfs->pfs_pid = (pid_t) pid;
pfs->pfs_type = pfs_type;
diff --git a/sys/miscfs/umapfs/umap_subr.c b/sys/miscfs/umapfs/umap_subr.c
index 792f4a87b05e..a65a5bb03009 100644
--- a/sys/miscfs/umapfs/umap_subr.c
+++ b/sys/miscfs/umapfs/umap_subr.c
@@ -35,7 +35,7 @@
*
* @(#)umap_subr.c 8.6 (Berkeley) 1/26/94
*
- * $Id: umap_subr.c,v 1.3 1994/10/10 07:55:43 phk Exp $
+ * $Id: umap_subr.c,v 1.4 1995/05/30 08:07:17 rgrimes Exp $
*/
#include <sys/param.h>
@@ -212,13 +212,23 @@ umap_node_alloc(mp, lowervp, vpp)
struct vnode *othervp, *vp;
int error;
+ /* XXX This routine probably needs a node_alloc lock */
+
+ /*
+ * Do the MALLOC before the getnewvnode since doing so afterward
+ * might cause a bogus v_data pointer to get dereferenced
+ * elsewhere if MALLOC should block.
+ */
+ MALLOC(xp, struct umap_node *, sizeof(struct umap_node),
+ M_TEMP, M_WAITOK);
+
error = getnewvnode(VT_UMAP, mp, umap_vnodeop_p, vpp);
- if (error)
+ if (error) {
+ FREE(xp, M_TEMP);
return (error);
+ }
vp = *vpp;
- MALLOC(xp, struct umap_node *, sizeof(struct umap_node),
- M_TEMP, M_WAITOK);
vp->v_type = lowervp->v_type;
xp->umap_vnode = vp;
vp->v_data = xp;
diff --git a/sys/msdosfs/msdosfs_denode.c b/sys/msdosfs/msdosfs_denode.c
index 60a68111833d..0223ff2aaa0f 100644
--- a/sys/msdosfs/msdosfs_denode.c
+++ b/sys/msdosfs/msdosfs_denode.c
@@ -1,4 +1,4 @@
-/* $Id: msdosfs_denode.c,v 1.11 1995/04/11 17:13:17 bde Exp $ */
+/* $Id: msdosfs_denode.c,v 1.12 1995/05/30 08:07:37 rgrimes Exp $ */
/* $NetBSD: msdosfs_denode.c,v 1.9 1994/08/21 18:44:00 ws Exp $ */
/*-
@@ -200,6 +200,12 @@ deget(pmp, dirclust, diroffset, direntptr, depp)
return 0;
}
+ /*
+ * Do the MALLOC before the getnewvnode since doing so afterward
+ * might cause a bogus v_data pointer to get dereferenced
+ * elsewhere if MALLOC should block.
+ */
+ MALLOC(ldep, struct denode *, sizeof(struct denode), M_MSDOSFSNODE, M_WAITOK);
/*
* Directory entry was not in cache, have to create a vnode and
@@ -208,10 +214,10 @@ deget(pmp, dirclust, diroffset, direntptr, depp)
/* getnewvnode() does a VREF() on the vnode */
error = getnewvnode(VT_MSDOSFS, mntp, msdosfs_vnodeop_p, &nvp);
if (error) {
- *depp = 0;
+ *depp = NULL;
+ FREE(ldep, M_MSDOSFSNODE);
return error;
}
- MALLOC(ldep, struct denode *, sizeof(struct denode), M_MSDOSFSNODE, M_WAITOK);
bzero((caddr_t)ldep, sizeof *ldep);
nvp->v_data = ldep;
ldep->de_vnode = nvp;
diff --git a/sys/nfs/nfs_node.c b/sys/nfs/nfs_node.c
index a6bf9000738f..dbc45f187f3d 100644
--- a/sys/nfs/nfs_node.c
+++ b/sys/nfs/nfs_node.c
@@ -34,7 +34,7 @@
* SUCH DAMAGE.
*
* @(#)nfs_node.c 8.2 (Berkeley) 12/30/93
- * $Id: nfs_node.c,v 1.8 1995/03/16 18:15:36 bde Exp $
+ * $Id: nfs_node.c,v 1.8.4.1 1995/07/22 03:40:56 davidg Exp $
*/
#include <sys/param.h>
@@ -139,16 +139,23 @@ loop:
}
nfs_node_hash_lock = 1;
+ /*
+ * Do the MALLOC before the getnewvnode since doing so afterward
+ * might cause a bogus v_data pointer to get dereferenced
+ * elsewhere if MALLOC should block.
+ */
+ MALLOC(np, struct nfsnode *, sizeof *np, M_NFSNODE, M_WAITOK);
+
error = getnewvnode(VT_NFS, mntp, nfsv2_vnodeop_p, &nvp);
if (error) {
if (nfs_node_hash_lock < 0)
wakeup(&nfs_node_hash_lock);
nfs_node_hash_lock = 0;
- *npp = 0;
+ *npp = NULL;
+ FREE(np, M_NFSNODE);
return (error);
}
vp = nvp;
- MALLOC(np, struct nfsnode *, sizeof *np, M_NFSNODE, M_WAITOK);
vp->v_data = np;
np->n_vnode = vp;
/*
diff --git a/sys/ufs/ffs/ffs_vfsops.c b/sys/ufs/ffs/ffs_vfsops.c
index b59d138ac726..400244319dea 100644
--- a/sys/ufs/ffs/ffs_vfsops.c
+++ b/sys/ufs/ffs/ffs_vfsops.c
@@ -31,7 +31,7 @@
* SUCH DAMAGE.
*
* @(#)ffs_vfsops.c 8.8 (Berkeley) 4/18/94
- * $Id: ffs_vfsops.c,v 1.21.4.1 1995/07/22 03:43:39 davidg Exp $
+ * $Id: ffs_vfsops.c,v 1.21.4.2 1996/06/11 05:17:34 bde Exp $
*/
#include <sys/param.h>
@@ -776,6 +776,16 @@ restart:
}
ffs_inode_hash_lock = 1;
+ /*
+ * If this MALLOC() is performed after the getnewvnode()
+ * it might block, leaving a vnode with a NULL v_data to be
+ * found by ffs_sync() if a sync happens to fire right then,
+ * which will cause a panic because ffs_sync() blindly
+ * dereferences vp->v_data (as well it should).
+ */
+ type = ump->um_devvp->v_tag == VT_MFS ? M_MFSNODE : M_FFSNODE; /* XXX */
+ MALLOC(ip, struct inode *, sizeof(struct inode), type, M_WAITOK);
+
/* Allocate a new vnode/inode. */
error = getnewvnode(VT_UFS, mp, ffs_vnodeop_p, &vp);
if (error) {
@@ -783,10 +793,9 @@ restart:
wakeup(&ffs_inode_hash_lock);
ffs_inode_hash_lock = 0;
*vpp = NULL;
+ FREE(ip, type);
return (error);
}
- type = ump->um_devvp->v_tag == VT_MFS ? M_MFSNODE : M_FFSNODE; /* XXX */
- MALLOC(ip, struct inode *, sizeof(struct inode), type, M_WAITOK);
bzero((caddr_t)ip, sizeof(struct inode));
vp->v_data = ip;
ip->i_vnode = vp;
diff --git a/sys/ufs/lfs/lfs_alloc.c b/sys/ufs/lfs/lfs_alloc.c
index fb60c3dfc954..fc48f62d009d 100644
--- a/sys/ufs/lfs/lfs_alloc.c
+++ b/sys/ufs/lfs/lfs_alloc.c
@@ -31,7 +31,7 @@
* SUCH DAMAGE.
*
* @(#)lfs_alloc.c 8.4 (Berkeley) 1/4/94
- * $Id: lfs_alloc.c,v 1.7 1995/03/28 07:58:02 bde Exp $
+ * $Id: lfs_alloc.c,v 1.8 1995/04/16 11:25:47 davidg Exp $
*/
#include <sys/param.h>
@@ -162,9 +162,17 @@ lfs_vcreate(mp, ino, vpp)
struct ufsmount *ump;
int error, i;
+ /*
+ * Do the MALLOC before the getnewvnode since doing so afterward
+ * might cause a bogus v_data pointer to get dereferenced
+ * elsewhere if MALLOC should block.
+ */
+ MALLOC(ip, struct inode *, sizeof(struct inode), M_LFSNODE, M_WAITOK);
+
/* Create the vnode. */
if (error = getnewvnode(VT_LFS, mp, lfs_vnodeop_p, vpp)) {
*vpp = NULL;
+ FREE(ip, M_LFSNODE);
return (error);
}
@@ -172,7 +180,6 @@ lfs_vcreate(mp, ino, vpp)
ump = VFSTOUFS(mp);
/* Initialize the inode. */
- MALLOC(ip, struct inode *, sizeof(struct inode), M_LFSNODE, M_WAITOK);
(*vpp)->v_data = ip;
ip->i_vnode = *vpp;
ip->i_devvp = ump->um_devvp;
diff --git a/sys/ufs/mfs/mfs_vfsops.c b/sys/ufs/mfs/mfs_vfsops.c
index dee40871c0df..643a2073a8d9 100644
--- a/sys/ufs/mfs/mfs_vfsops.c
+++ b/sys/ufs/mfs/mfs_vfsops.c
@@ -31,7 +31,7 @@
* SUCH DAMAGE.
*
* @(#)mfs_vfsops.c 8.4 (Berkeley) 4/16/94
- * $Id: mfs_vfsops.c,v 1.9 1995/05/29 03:27:37 phk Exp $
+ * $Id: mfs_vfsops.c,v 1.9.4.1 1995/08/24 06:06:25 davidg Exp $
*/
#include <sys/param.h>
@@ -220,13 +220,21 @@ mfs_mount(mp, path, data, ndp, p)
#endif
return (0);
}
+ /*
+ * Do the MALLOC before the getnewvnode since doing so afterward
+ * might cause a bogus v_data pointer to get dereferenced
+ * elsewhere if MALLOC should block.
+ */
+ MALLOC(mfsp, struct mfsnode *, sizeof *mfsp, M_MFSNODE, M_WAITOK);
+
error = getnewvnode(VT_MFS, (struct mount *)0, mfs_vnodeop_p, &devvp);
- if (error)
+ if (error) {
+ FREE(mfsp, M_MFSNODE);
return (error);
+ }
devvp->v_type = VBLK;
if (checkalias(devvp, makedev(255, mfs_minor++), (struct mount *)0))
panic("mfs_mount: dup dev");
- mfsp = (struct mfsnode *)malloc(sizeof *mfsp, M_MFSNODE, M_WAITOK);
devvp->v_data = mfsp;
mfsp->mfs_baseoff = args.base;
mfsp->mfs_size = args.size;
generated by cgit v1.3 (git 2.53.0) at 2026-07-29 04:58:33 +0000