Author: kib Date: Mon Jun 19 15:17:17 2017 New Revision: 320108 URL: https://svnweb.freebsd.org/changeset/base/320108
Log: Allow negative aio_offset only for the read and write LIO ops on device nodes. Otherwise, the current check of aio_offset == -1LL makes it possible to pass negative file offsets down to the filesystems. This trips assertions and is even unsafe for e.g. FFS which keeps metadata at negative offsets. Reported and tested by: pho Reviewed by: jhb Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D11266 Modified: head/sys/kern/vfs_aio.c Modified: head/sys/kern/vfs_aio.c ============================================================================== --- head/sys/kern/vfs_aio.c Mon Jun 19 15:16:47 2017 (r320107) +++ head/sys/kern/vfs_aio.c Mon Jun 19 15:17:17 2017 (r320108) @@ -1550,7 +1550,9 @@ aio_aqueue(struct thread *td, struct aiocb *ujob, stru goto aqueue_fail; } - if (opcode != LIO_SYNC && job->uaiocb.aio_offset == -1LL) { + if ((opcode == LIO_READ || opcode == LIO_WRITE) && + job->uaiocb.aio_offset < 0 && + (fp->f_vnode == NULL || fp->f_vnode->v_type != VCHR)) { error = EINVAL; goto aqueue_fail; } _______________________________________________ svn-src-all@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/svn-src-all To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
