BSD: Work around panic in FlushVCache 14/13014/3
authorBenjamin Kaduk <kaduk@mit.edu>
Fri, 13 Apr 2018 13:07:59 +0000 (08:07 -0500)
committerBenjamin Kaduk <kaduk@mit.edu>
Tue, 8 May 2018 12:34:50 +0000 (08:34 -0400)
commit54e84a98f9747bb5bb2ad4b8031115ad7684c914
tree0dd9c81e221a6cd94f93189e2cdfccd6e0cce9d2
parentcfa74883e4996dfee2bd6ffaa3b967e5a7941e0b
BSD: Work around panic in FlushVCache

Commit 64cc7f0ca7a44bb214396c829268a541ab286c69 created the very useful
afs_StaleVCache() helper function, but unfortunately it also introduced
a subtle change into how we check for whether a vcache may be a directory.
Previously, we just used the low bit of the Fid's Vnode number, since files
have an even number and non-files an odd number.  The new version uses
that check but also explicitly checks `vType(avc)` against VDIR, and this new
check involves consulting information stored in the associated vnode entry,
not the vcache directly.  The afs_FlushVCache() implementation for
XBSD and DARWIN NULLs removes the cross-linkage between vcache and vnode,
so that AFSTOV(avc) becomes NULL.  Just a few lines later, it calls
afs_StaleVCacheFlags(), at which point vType() dereferences a bad pointer
(offset from a NULL pointer) and panics.  This would happen during shutdown,
or other periodic reclaim/flush events that can be scheduled.

Change-Id: I0800e5c743cedcbec628bfa8c8ea8978c2488c1c
Reviewed-on: https://gerrit.openafs.org/13014
Reviewed-by: Mark Vitale <mvitale@sinenomine.net>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Andrew Deason <adeason@sinenomine.net>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
src/afs/afs_vcache.c