vfscore_vget returns 1 if the vnode was found in cache, 0 otherwise.
If we fall back to allocating a new vnode (vn_lookup returned NULL)
then the vnode was not found in cache and it does not make sense to
return anything else than 0.
In particular, this line is reached if VFS_VGET fails, meaning that
error will systematically be > 0. Since most calls to vfscore_vget
check for > 0 instead of == 1, they will assume that the vnode was
found in cache and dereference vpp without previously checking it,
causing a NULL pointer dereference.
This is not an issue for the moment since all vfs_vget implementations
are linked to vfscore_nullop, but might become an issue in the future
when those will be implemented.
Signed-off-by: Hugo Lefeuvre <hugo.lefeuvre@xxxxxxxxx>
---
Changes since v1:
- do not change error codes in ramfs_vnops.c as truncate and ftruncate
(functions from libc using ramfs_truncate and ramfs_write) do not
return ENOMEM.
diff --git a/lib/vfscore/vnode.c b/lib/vfscore/vnode.c
index 6b5ea12..f3f1644 100644
--- a/lib/vfscore/vnode.c
+++ b/lib/vfscore/vnode.c
@@ -209,7 +209,7 @@ vfscore_vget(struct mount *mp, uint64_t ino, struct vnode
**vpp)
if ((error = VFS_VGET(mp, vp)) != 0) {
VNODE_UNLOCK();
free(vp);
- return error;
+ return 0;
}
vfs_busy(vp->v_mount);
uk_mutex_lock(&vp->v_lock);
_______________________________________________
Minios-devel mailing list
Minios-devel@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/minios-devel
