Print this page
Caution with use after exi_rele()
Be far more judicious in the use of curzone-using macros.

Split Close
Expand all
Collapse all
          --- old/usr/src/uts/common/fs/nfs/nfs3_srv.c
          +++ new/usr/src/uts/common/fs/nfs/nfs3_srv.c
↓ open down ↓ 403 lines elided ↑ open up ↑
 404  404          dvap = NULL;
 405  405  
 406  406          if (exi != NULL)
 407  407                  exi_hold(exi);
 408  408  
 409  409          /*
 410  410           * Allow lookups from the root - the default
 411  411           * location of the public filehandle.
 412  412           */
 413  413          if (exi != NULL && (exi->exi_export.ex_flags & EX_PUBLIC)) {
      414 +                ASSERT3U(exi->exi_zoneid, ==, curzone->zone_id);
 414  415                  dvp = ZONE_ROOTVP();
 415  416                  VN_HOLD(dvp);
 416  417  
 417  418                  DTRACE_NFSV3_5(op__lookup__start, struct svc_req *, req,
 418  419                      cred_t *, cr, vnode_t *, dvp, struct exportinfo *, exi,
 419  420                      LOOKUP3args *, args);
 420  421          } else {
 421  422                  dvp = nfs3_fhtovp(&args->what.dir, exi);
 422  423  
 423  424                  DTRACE_NFSV3_5(op__lookup__start, struct svc_req *, req,
↓ open down ↓ 48 lines elided ↑ open up ↑
 472  473          }
 473  474  
 474  475          /*
 475  476           * If the public filehandle is used then allow
 476  477           * a multi-component lookup
 477  478           */
 478  479          if (PUBLIC_FH3(&args->what.dir)) {
 479  480                  publicfh_flag = TRUE;
 480  481  
 481  482                  exi_rele(exi);
      483 +                exi = NULL;
 482  484  
 483  485                  error = rfs_publicfh_mclookup(name, dvp, cr, &vp,
 484  486                      &exi, &sec);
 485  487  
 486  488                  /*
 487  489                   * Since WebNFS may bypass MOUNT, we need to ensure this
 488  490                   * request didn't come from an unlabeled admin_low client.
 489  491                   */
 490  492                  if (is_system_labeled() && error == 0) {
 491  493                          int             addr_type;
↓ open down ↓ 63 lines elided ↑ open up ↑
 555  557          }
 556  558  
 557  559          if (error) {
 558  560                  VN_RELE(vp);
 559  561                  goto out;
 560  562          }
 561  563  
 562  564          va.va_mask = AT_ALL;
 563  565          vap = rfs4_delegated_getattr(vp, &va, 0, cr) ? NULL : &va;
 564  566  
 565      -        exi_rele(exi);
 566  567          VN_RELE(vp);
 567  568  
 568  569          resp->status = NFS3_OK;
 569  570          vattr_to_post_op_attr(vap, &resp->resok.obj_attributes);
 570  571          vattr_to_post_op_attr(dvap, &resp->resok.dir_attributes);
 571  572  
 572  573          /*
 573  574           * If it's public fh, no 0x81, and client's flavor is
 574  575           * invalid, set WebNFS status to WNFSERR_CLNT_FLAVOR now.
 575  576           * Then set RPC status to AUTH_TOOWEAK in common_dispatch.
 576  577           */
 577  578          if (auth_weak)
 578  579                  resp->status = (enum nfsstat3)WNFSERR_CLNT_FLAVOR;
 579  580  
 580  581          DTRACE_NFSV3_5(op__lookup__done, struct svc_req *, req,
 581  582              cred_t *, cr, vnode_t *, dvp, struct exportinfo *, exi,
 582  583              LOOKUP3res *, resp);
 583  584          VN_RELE(dvp);
      585 +        exi_rele(exi);
 584  586  
 585  587          return;
 586  588  
 587  589  out:
 588  590          if (curthread->t_flag & T_WOULDBLOCK) {
 589  591                  curthread->t_flag &= ~T_WOULDBLOCK;
 590  592                  resp->status = NFS3ERR_JUKEBOX;
 591  593          } else
 592  594                  resp->status = puterrno3(error);
 593  595  out1:
↓ open down ↓ 2073 lines elided ↑ open up ↑
2667 2669  
2668 2670          ca = (struct sockaddr *)svc_getrpccaller(req->rq_xprt)->buf;
2669 2671          name = nfscmd_convname(ca, exi, args->object.name,
2670 2672              NFSCMD_CONV_INBOUND, MAXPATHLEN + 1);
2671 2673  
2672 2674          if (name == NULL) {
2673 2675                  resp->status = NFS3ERR_INVAL;
2674 2676                  goto err1;
2675 2677          }
2676 2678  
     2679 +        ASSERT3U(exi->exi_zoneid, ==, curzone->zone_id);
2677 2680          error = VOP_RMDIR(vp, name, ZONE_ROOTVP(), cr, NULL, 0);
2678 2681  
2679 2682          if (name != args->object.name)
2680 2683                  kmem_free(name, MAXPATHLEN + 1);
2681 2684  
2682 2685          ava.va_mask = AT_ALL;
2683 2686          avap = VOP_GETATTR(vp, &ava, 0, cr, NULL) ? NULL : &ava;
2684 2687  
2685 2688          /*
2686 2689           * Force modified data and metadata out to stable storage.
↓ open down ↓ 1776 lines elided ↑ open up ↑
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX