Date: Mon, 19 Jun 2017 15:17:17 +0000 (UTC) From: Konstantin Belousov <kib@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r320108 - head/sys/kern Message-ID: <201706191517.v5JFHHQc095682@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: kib Date: Mon Jun 19 15:17:17 2017 New Revision: 320108 URL: https://svnweb.freebsd.org/changeset/base/320108 Log: Allow negative aio_offset only for the read and write LIO ops on device nodes. Otherwise, the current check of aio_offset == -1LL makes it possible to pass negative file offsets down to the filesystems. This trips assertions and is even unsafe for e.g. FFS which keeps metadata at negative offsets. Reported and tested by: pho Reviewed by: jhb Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D11266 Modified: head/sys/kern/vfs_aio.c Modified: head/sys/kern/vfs_aio.c ============================================================================== --- head/sys/kern/vfs_aio.c Mon Jun 19 15:16:47 2017 (r320107) +++ head/sys/kern/vfs_aio.c Mon Jun 19 15:17:17 2017 (r320108) @@ -1550,7 +1550,9 @@ aio_aqueue(struct thread *td, struct aiocb *ujob, stru goto aqueue_fail; } - if (opcode != LIO_SYNC && job->uaiocb.aio_offset == -1LL) { + if ((opcode == LIO_READ || opcode == LIO_WRITE) && + job->uaiocb.aio_offset < 0 && + (fp->f_vnode == NULL || fp->f_vnode->v_type != VCHR)) { error = EINVAL; goto aqueue_fail; }
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201706191517.v5JFHHQc095682>