shithub: riscv

Download patch

ref: 89e63156991a50263eb6481934ce1c40e4a13036
parent: 16e08adb32778864035cc582c3a9163d3032ca4b
author: cinap_lenrek <cinap_lenrek@felloff.net>
date: Thu Oct 23 19:59:16 EDT 2014

lib9p: fix .. walk crash in deleted directory (thanks BurnZeZ)

to reproduce:

 % ramfs; cd /tmp
 % mkdir foo; cd foo
 % pwd
 /tmp/foo
 % rm /tmp/foo
 % pwd
 /tmp/foo
 % ls
 % ls /tmp
 % ls ..
 ramfs 202751: suicide: sys: trap: fault read addr=0x0 pc=0x0000e46d
 ls: ..: '..' mount rpc error

--- a/sys/src/lib9p/file.c

+++ b/sys/src/lib9p/file.c

@@ -254,7 +254,8 @@

 	rlock(dir);

 	if(strcmp(elem, "..") == 0){

 		fp = dir->parent;

-		incref(fp);

+		if(fp != nil)

+			incref(fp);

 		runlock(dir);

 		closefile(dir);

 		return fp;