kernel - Fix kernel panic caused by rename race
authorMatthew Dillon <dillon@apollo.backplane.com>
Fri, 1 Feb 2013 21:47:37 +0000 (13:47 -0800)
committerMatthew Dillon <dillon@apollo.backplane.com>
Fri, 1 Feb 2013 21:47:37 +0000 (13:47 -0800)
commite2a099cf1b1188b60aecc18de449444f7dca0f6a
tree2c044bc00c73c1f5fd1f3c9fa74b06921a7ef85d
parent245d8a0dfa548142367bafba756f1dda2b822750
kernel - Fix kernel panic caused by rename race

* kern_rename() must temporarily unlock the source ncp when resolving the
  target ncp, and will sometimes have to temporarily unlock the target ncp
  when relocking both.  This can race against a topological removal of one
  or both ncp's, resulting in incorrect operation or a panic due to a
  NULL vp.

* Detect the case and return EAGAIN if the ncp's have been marked NCF_DESTROYED
  or if fromncp loses its vp resolution.  Callers detect the EAGAIN and retry
  the operation.

Reported-by: ftigeot
sys/emulation/linux/linux_file.c
sys/kern/vfs_syscalls.c