From 6de3cf14c47d97b423ae25d5bd1d80b896ecd9e6 Mon Sep 17 00:00:00 2001 From: Konstantin Belousov Date: Wed, 12 May 2021 22:04:44 +0300 Subject: [PATCH] vn_open_cred(): disallow O_CREAT | O_EMPTY_PATH This combination does not make sense, and cannot be satisfied by lookup. In particular, lookup cannot supply dvp, it only can directly return vp. Reported and reviewed by: markj using syzkaller Sponsored by: The FreeBSD Foundation MFC after: 3 days --- sys/kern/vfs_vnops.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/sys/kern/vfs_vnops.c b/sys/kern/vfs_vnops.c index 670bc4bf8fc..8f583329f06 100644 --- a/sys/kern/vfs_vnops.c +++ b/sys/kern/vfs_vnops.c @@ -233,7 +233,8 @@ vn_open_cred(struct nameidata *ndp, int *flagp, int cmode, u_int vn_open_flags, first_open = false; fmode = *flagp; if ((fmode & (O_CREAT | O_EXCL | O_DIRECTORY)) == (O_CREAT | - O_EXCL | O_DIRECTORY)) + O_EXCL | O_DIRECTORY) || + (fmode & (O_CREAT | O_EMPTY_PATH)) == (O_CREAT | O_EMPTY_PATH)) return (EINVAL); else if ((fmode & (O_CREAT | O_DIRECTORY)) == O_CREAT) { ndp->ni_cnd.cn_nameiop = CREATE; -- 2.45.2