Tue Sep 29 11:17:00 2009 UTC ()

Give rump_sys_unmount() in ukfs_release() a curlwp context.  This
prevents use-after-free and should fix crashy cases reported by
Arnaud Ysmal.


(pooka)

diff -r1.35 -r1.36 src/lib/libukfs/ukfs.c

--- src/lib/libukfs/ukfs.c 2009/08/04 12:37:14	1.35
+++ src/lib/libukfs/ukfs.c 2009/09/29 11:17:00	1.36

 @@ -1,14 +1,14 @@
-/*	$NetBSD: ukfs.c,v 1.35 2009/08/04 12:37:14 pooka Exp $	*/
+/*	$NetBSD: ukfs.c,v 1.36 2009/09/29 11:17:00 pooka Exp $	*/
 /*
  * Copyright (c) 2007, 2008  Antti Kantee.  All Rights Reserved.
+ *
  * Development of this software was supported by the
  * Finnish Cultural Foundation.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
 @@ -298,27 +298,29 @@ ukfs_mount(const char *vfsname, const ch
+}
 int
 ukfs_release(struct ukfs *fs, int flags)
+{
 	if ((flags & UKFS_RELFLAG_NOUNMOUNT) == 0) {
 		int rv, mntflag;
 		ukfs_chdir(fs, "/");
 		mntflag = 0;
 		if (flags & UKFS_RELFLAG_FORCE)
 			mntflag = MNT_FORCE;
 		rump_setup_curlwp(nextpid(fs), 1, 1);
 		rv = rump_sys_unmount(fs->ukfs_mountpath, mntflag);
 		rump_clear_curlwp();
 		if (rv) {
 			ukfs_chdir(fs, fs->ukfs_mountpath);
 			errno = rv;
 			return -1;
+		}
+	}
 	if (fs->ukfs_devpath) {
 		rump_etfs_remove(fs->ukfs_devpath);
 		free(fs->ukfs_devpath);
+	}
 	free(fs->ukfs_mountpath);