Ticket #3124: panic_at_vnode_name.diff

src/system/kernel/device_manager/legacy_drivers.cpp

@@ -266 +266 @@
         // the device was not present before -> publish it now
         TRACE(("devfs: publishing new device \"%s\"\n", devicePaths[0]));
         device = new(std::nothrow) LegacyDevice(driver, devicePaths[0], hooks);
+
+        ktrace_printf("republish_driver: driver->path=%s, "
+                "driver->name=%s, devicePaths[0]=%s\n",
+                driver->path, driver->name, devicePaths[0]);
+
         if (device != NULL && device->InitCheck() == B_OK
             && devfs_publish_device(devicePaths[0], device) == B_OK) {
             driver->devices.Add(device);
@@ -281 +286 @@
             continue;
 
         TRACE(("devfs: unpublishing no more present \"%s\"\n", device->Path()));
+        ktrace_printf("republish_device: unpublishing %s\n", device->Path());
         iterator.Remove();
 
         devfs_unpublish_device(device, true);

src/system/kernel/device_manager/devfs.cpp

@@ -215 +215 @@
 {
     struct devfs_vnode* vnode;
 
+    ktrace_printf("devfs_create_vnode: fs=%p, parent=%p, name=%s\n", fs,parent,name);
+    if (name[0] < 0)
+        panic("devfs_create_vnode: name[0] < 0");
+
     vnode = (struct devfs_vnode*)malloc(sizeof(struct devfs_vnode));
     if (vnode == NULL)
         return NULL;
@@ -514 +518 @@
     if (tempPath.InitCheck() != B_OK)
         return B_NO_MEMORY;
 
+
+    ktrace_printf("publish_directory: %s\n", path);
     TRACE(("devfs: publish directory \"%s\"\n", path));
     char *temp = tempPath.LockBuffer();
 
@@ -584 +590 @@
     if (tempPath.InitCheck() != B_OK)
         return B_NO_MEMORY;
 
+    ktrace_printf("new_node: %s\n", path);
+
     char *temp = tempPath.LockBuffer();
 
     // create the path leading to the device
@@ -675 +683 @@
 publish_device(struct devfs* fs, const char* path, BaseDevice* device)
 {
     TRACE(("publish_device(path = \"%s\", device = %p)\n", path, device));
+    ktrace_printf("publish_device: %s\n", path);
 
     if (sDeviceFileSystem == NULL) {
         panic("publish_device() called before devfs mounted\n");

src/system/kernel/fs/vfs.cpp

@@ -5464 +5464 @@
     char buffer[sizeof(struct dirent) + B_FILE_NAME_LENGTH];
     struct dirent* entry;
 
+    bzero(&buffer, sizeof(buffer));
+
     if (IS_USER_ADDRESS(userEntry)) {
         entry = (struct dirent*)buffer;
         if (user_memcpy(entry, userEntry, sizeof(struct dirent) - 1) != B_OK)
@@ -5471 +5473 @@
 
         ASSERT(entry->d_reclen >= sizeof(struct dirent));
 
+        if ( entry->d_reclen > sizeof(buffer))
+        {
+            char tmpBuf[2048];
+            char *pos = tmpBuf;
+            unsigned i;
+
+            for (i = 0; i < entry->d_reclen - sizeof(struct dirent) + 1; i++)
+                pos += sprintf(pos, "%02x ", (unsigned char)(userEntry->d_name[i]));
+
+            ktrace_printf("fix_dirent: name is %s\n", tmpBuf);
+
+            panic("%d = entry->d_reclen > sizeof(buffer) = %d", entry->d_reclen, (unsigned)sizeof(buffer));
+
+            entry->d_reclen = sizeof(buffer) - 1;
+        }
+
         if (user_memcpy(entry->d_name, userEntry->d_name,
-                entry->d_reclen - sizeof(struct dirent)) != B_OK)
+                entry->d_reclen - sizeof(struct dirent) + 1) != B_OK)
             return B_BAD_ADDRESS;
     } else
         entry = userEntry;
 
+    ktrace_printf("fix_dirent: _length=%p, entry=%p, parent=%p, entry->d_name=%s\n",
+            _length, entry,parent, entry->d_name);
     *_length = entry->d_reclen;
 
     // set d_pdev and d_pino
@@ -5549 +5569 @@
     if (count > 0) {
         for (uint32 i = 0; i < count; i++) {
             uint32 length;
+            ktrace_printf("dir_read: cookie=%p, _count=%p, count=%d, i=%d, bufferSize=%d\n",
+                    cookie, _count, (unsigned)count, (unsigned)i, (unsigned)bufferSize);
+            ktrace_printf("fix_dirent args: parent=%p, userEntry=%p, ioContext=%p, _length=%p\n",
+                    vnode, buffer, ioContext, &length);
             error = fix_dirent(vnode, buffer, ioContext, &length);
             if (error != B_OK)
                 return error;