Print this page
7656 unlinking directory on tmpfs can cause kernel panic


1088         struct vnode *dvp,
1089         char *nm,
1090         struct cred *cred,
1091         caller_context_t *ct,
1092         int flags)
1093 {
1094         struct tmpnode *parent = (struct tmpnode *)VTOTN(dvp);
1095         int error;
1096         struct tmpnode *tp = NULL;
1097 
1098         error = tdirlookup(parent, nm, &tp, cred);
1099         if (error)
1100                 return (error);
1101 
1102         ASSERT(tp);
1103         rw_enter(&parent->tn_rwlock, RW_WRITER);
1104         rw_enter(&tp->tn_rwlock, RW_WRITER);
1105 
1106         if (tp->tn_type != VDIR ||
1107             (error = secpolicy_fs_linkdir(cred, dvp->v_vfsp)) == 0)
1108                 error = tdirdelete(parent, tp, nm, tp->tn_type == VDIR ?
1109                     DR_RMDIR : DR_REMOVE, cred);
1110 
1111         rw_exit(&tp->tn_rwlock);
1112         rw_exit(&parent->tn_rwlock);
1113         vnevent_remove(TNTOV(tp), dvp, nm, ct);
1114         tmpnode_rele(tp);
1115 
1116         TRACE_3(TR_FAC_TMPFS, TR_TMPFS_REMOVE,
1117             "tmpfs remove:dvp %p nm %s error %d", dvp, nm, error);
1118         return (error);
1119 }
1120 
1121 /* ARGSUSED4 */
1122 static int
1123 tmp_link(
1124         struct vnode *dvp,
1125         struct vnode *srcvp,
1126         char *tnm,
1127         struct cred *cred,
1128         caller_context_t *ct,
1129         int flags)




1088         struct vnode *dvp,
1089         char *nm,
1090         struct cred *cred,
1091         caller_context_t *ct,
1092         int flags)
1093 {
1094         struct tmpnode *parent = (struct tmpnode *)VTOTN(dvp);
1095         int error;
1096         struct tmpnode *tp = NULL;
1097 
1098         error = tdirlookup(parent, nm, &tp, cred);
1099         if (error)
1100                 return (error);
1101 
1102         ASSERT(tp);
1103         rw_enter(&parent->tn_rwlock, RW_WRITER);
1104         rw_enter(&tp->tn_rwlock, RW_WRITER);
1105 
1106         if (tp->tn_type != VDIR ||
1107             (error = secpolicy_fs_linkdir(cred, dvp->v_vfsp)) == 0)
1108                 error = tdirdelete(parent, tp, nm, DR_REMOVE, cred);

1109 
1110         rw_exit(&tp->tn_rwlock);
1111         rw_exit(&parent->tn_rwlock);
1112         vnevent_remove(TNTOV(tp), dvp, nm, ct);
1113         tmpnode_rele(tp);
1114 
1115         TRACE_3(TR_FAC_TMPFS, TR_TMPFS_REMOVE,
1116             "tmpfs remove:dvp %p nm %s error %d", dvp, nm, error);
1117         return (error);
1118 }
1119 
1120 /* ARGSUSED4 */
1121 static int
1122 tmp_link(
1123         struct vnode *dvp,
1124         struct vnode *srcvp,
1125         char *tnm,
1126         struct cred *cred,
1127         caller_context_t *ct,
1128         int flags)