diff options
| author | Mark Johnston <markj@FreeBSD.org> | 2022-02-08 17:34:20 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2022-02-08 17:40:41 +0000 |
| commit | 300cfb96fc2253c3aff8d501d5599fcf811daa34 (patch) | |
| tree | a65b0f02d8c3a92e7a5d57cdc75c34bd80e9480c /sys/kern/kern_descrip.c | |
| parent | 927aa5fefd4c69e72d44189a04fadf80e42d0ad8 (diff) | |
| download | src-300cfb96fc2253c3aff8d501d5599fcf811daa34.tar.gz src-300cfb96fc2253c3aff8d501d5599fcf811daa34.zip | |
file: Make fget*() and getvnode*() consistent about initializing *fpp
Most fget*() functions initialize the output parameter to NULL. Make
the externally visible interface behave consistently, and make
fget_unlocked_seq() private to kern_descrip.c.
This fixes at least one bug in a consumer, _filemon_wrapper_openat(),
which assumes that getvnode() sets the output file pointer to NULL upon
an error.
Reported by: syzbot+01c0459408f896a5933a@syzkaller.appspotmail.com
Reviewed by: kib
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D34190
Diffstat (limited to 'sys/kern/kern_descrip.c')
| -rw-r--r-- | sys/kern/kern_descrip.c | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/sys/kern/kern_descrip.c b/sys/kern/kern_descrip.c index d5d22ecfc522..c4cf9abde664 100644 --- a/sys/kern/kern_descrip.c +++ b/sys/kern/kern_descrip.c @@ -115,6 +115,8 @@ static void fdgrowtable(struct filedesc *fdp, int nfd); static void fdgrowtable_exp(struct filedesc *fdp, int nfd); static void fdunused(struct filedesc *fdp, int fd); static void fdused(struct filedesc *fdp, int fd); +static int fget_unlocked_seq(struct filedesc *fdp, int fd, + cap_rights_t *needrightsp, struct file **fpp, seqc_t *seqp); static int getmaxfd(struct thread *td); static u_long *filecaps_copy_prep(const struct filecaps *src); static void filecaps_copy_finish(const struct filecaps *src, @@ -2843,6 +2845,7 @@ fget_cap_locked(struct filedesc *fdp, int fd, cap_rights_t *needrightsp, FILEDESC_LOCK_ASSERT(fdp); + *fpp = NULL; fde = fdeget_locked(fdp, fd); if (fde == NULL) { error = EBADF; @@ -3014,7 +3017,7 @@ fgetvp_lookup_smr(int fd, struct nameidata *ndp, struct vnode **vpp, bool *fsear } #endif -int +static int fget_unlocked_seq(struct filedesc *fdp, int fd, cap_rights_t *needrightsp, struct file **fpp, seqc_t *seqp) { @@ -3112,8 +3115,10 @@ fget_unlocked(struct filedesc *fdp, int fd, cap_rights_t *needrightsp, #endif fdt = fdp->fd_files; - if (__predict_false((u_int)fd >= fdt->fdt_nfiles)) + if (__predict_false((u_int)fd >= fdt->fdt_nfiles)) { + *fpp = NULL; return (EBADF); + } #ifdef CAPABILITIES seq = seqc_read_notmodify(fd_seqc(fdt, fd)); fde = &fdt->fdt_ofiles[fd]; @@ -3148,6 +3153,7 @@ fget_unlocked(struct filedesc *fdp, int fd, cap_rights_t *needrightsp, out_fdrop: fdrop(fp, curthread); out_fallback: + *fpp = NULL; return (fget_unlocked_seq(fdp, fd, needrightsp, fpp, NULL)); } @@ -3173,6 +3179,7 @@ fget_only_user(struct filedesc *fdp, int fd, cap_rights_t *needrightsp, MPASS(FILEDESC_IS_ONLY_USER(fdp)); + *fpp = NULL; if (__predict_false(fd >= fdp->fd_nfiles)) return (EBADF); @@ -3198,6 +3205,7 @@ fget_only_user(struct filedesc *fdp, int fd, cap_rights_t *needrightsp, MPASS(FILEDESC_IS_ONLY_USER(fdp)); + *fpp = NULL; if (__predict_false(fd >= fdp->fd_nfiles)) return (EBADF); |