From ff1a307801994e18a87929898225f09d31f3e1fa Mon Sep 17 00:00:00 2001
From: Alan Somers <asomers@FreeBSD.org>
Date: Sat, 9 Jan 2021 20:23:05 -0700
Subject: lio_listio: validate aio_lio_opcode

Previously, we would accept any kind of LIO_* opcode, including ones
that were intended for in-kernel use only like LIO_SYNC (which is not
defined in userland).  The situation became more serious with
022ca2fc7fe08d51f33a1d23a9be49e6d132914e.  After that revision, setting
aio_lio_opcode to LIO_WRITEV or LIO_READV would trigger an assertion.

Note that POSIX does not specify what should happen if aio_lio_opcode is
invalid.

MFC-with:	022ca2fc7fe08d51f33a1d23a9be49e6d132914e
Reviewed by:	jhb, tmunro, 0mp
Differential Revision:	<https://reviews.freebsd.org/D28078
---
 lib/libc/sys/aio_return.2 | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

(limited to 'lib/libc')

diff --git a/lib/libc/sys/aio_return.2 b/lib/libc/sys/aio_return.2
index d94fcc7eba62..aebe978fe140 100644
--- a/lib/libc/sys/aio_return.2
+++ b/lib/libc/sys/aio_return.2
@@ -24,7 +24,7 @@
 .\"
 .\" $FreeBSD$
 .\"
-.Dd January 2, 2021
+.Dd January 11, 2021
 .Dt AIO_RETURN 2
 .Os
 .Sh NAME
@@ -75,6 +75,12 @@ The
 .Fa iocb
 argument
 does not reference a completed asynchronous I/O request.
+.It Bq Er EINVAL
+The I/O operation was submitted with
+.Fn lio_listio ,
+and the value of the
+.Fa aio_lio_opcode
+is invalid.
 .El
 .Sh SEE ALSO
 .Xr aio_cancel 2 ,
-- 
cgit v1.2.3