⬢ DragonFlyBSD Kernel Audit
DF-3220 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
--- a/sys/vfs/dirfs/dirfs_vfsops.c	2026-06-29 12:51:19.000000000 +0000
+++ b/sys/vfs/dirfs/dirfs_vfsops.c	2026-10-26 03:31:04.643709374 +0000
@@ -128,8 +128,9 @@
 		/* Attempt to copy from kernel address */
 		error = copystr(data, &dmp->dm_path, MAXPATHLEN, &done);
 		if (error) {
+			mp->mnt_data = NULL;
 			kfree(dmp, M_DIRFS);
-			goto failure;
+			goto failure_nolog;
 		}
 	}
 
@@ -141,9 +142,10 @@
 	/* Make sure host directory exists and it is indeed a directory. */
 	if ((stat(dmp->dm_path, &st)) == 0) {
 		if (!S_ISDIR(st.st_mode)) {
+			mp->mnt_data = NULL;
 			kfree(dmp, M_DIRFS);
 			error = EINVAL;
-			goto failure;
+			goto failure_nolog;
 		}
 	} else {
 		error = errno;
@@ -169,7 +171,8 @@
 failure:
 	KTR_LOG(dirfs_mount, (dmp->dm_path) ? dmp->dm_path : "NULL",
 	    dmp, mp, error);
-
+failure_nolog:
+	/* dmp may already be freed; only mnt_data cleanup is left */
 	return error;
 }
 
@@ -273,7 +276,7 @@
 	 * call will handle any races and return a locked vnode.
 	 */
 	dirfs_alloc_vp(mp, vpp, LK_CANRECURSE, dnp);
-	KTR_LOG(dirfs_root, dnp, *vpp, dmp->dm_path, dnp->dn_fd, error);
+	KTR_LOG(dirfs_root, dnp, *vpp, dmp->dm_path, dnp->dn_fd, 0);
 
 	return 0;
 }
@@ -300,6 +303,7 @@
 	ksnprintf(st.f_mntfromname, MNAMELEN - 1, "dirfs@%s", dmp->dm_path);
 	bcopy(&st, sbp, sizeof(st));
 	strlcpy(sbp->f_fstypename, mp->mnt_vfc->vfc_name, MFSNAMELEN);
+	sbp->f_fsid = mp->mnt_stat.f_fsid;	/* keep per-mount fsid */
 	dbg(5, "iosize = %zd\n", sbp->f_iosize);
 
 	return 0;
@@ -317,6 +321,7 @@
 		return errno;
 
 	bcopy(&st, sbp, sizeof(st));
+	sbp->f_fsid = mp->mnt_stat.f_fsid;	/* keep per-mount fsid */
 
 	return 0;
 }