Author: markj Date: Sun Feb 17 16:43:44 2019 New Revision: 344232 URL: https://svnweb.freebsd.org/changeset/base/344232
Log: Fix refcount leaks in the SGX Linux compat ioctl handler. Some argument validation error paths would return without releasing the file reference obtained at the beginning of the function. While here, fix some style bugs and remove trivial debug prints. Reviewed by: kib MFC after: 1 week Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D19214 Modified: head/sys/amd64/sgx/sgx_linux.c Modified: head/sys/amd64/sgx/sgx_linux.c ============================================================================== --- head/sys/amd64/sgx/sgx_linux.c Sun Feb 17 16:35:19 2019 (r344231) +++ head/sys/amd64/sgx/sgx_linux.c Sun Feb 17 16:43:44 2019 (r344232) @@ -70,30 +70,26 @@ sgx_linux_ioctl(struct thread *td, struct linux_ioctl_ cmd = args->cmd; args->cmd &= ~(LINUX_IOC_IN | LINUX_IOC_OUT); - if (cmd & LINUX_IOC_IN) + if ((cmd & LINUX_IOC_IN) != 0) args->cmd |= IOC_IN; - if (cmd & LINUX_IOC_OUT) + if ((cmd & LINUX_IOC_OUT) != 0) args->cmd |= IOC_OUT; len = IOCPARM_LEN(cmd); if (len > SGX_IOCTL_MAX_DATA_LEN) { - printf("%s: Can't copy data: cmd len is too big %d\n", - __func__, len); - return (EINVAL); + error = EINVAL; + goto out; } - if (cmd & LINUX_IOC_IN) { + if ((cmd & LINUX_IOC_IN) != 0) { error = copyin((void *)args->arg, data, len); - if (error) { - printf("%s: Can't copy data, error %d\n", - __func__, error); - return (EINVAL); - } + if (error != 0) + goto out; } - error = (fo_ioctl(fp, args->cmd, (caddr_t)data, td->td_ucred, td)); + error = fo_ioctl(fp, args->cmd, (caddr_t)data, td->td_ucred, td); +out: fdrop(fp, td); - return (error); } _______________________________________________ svn-src-all@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/svn-src-all To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
