From 7ce75e5f1fc80e737cdd6e46d37e512518017a82 Mon Sep 17 00:00:00 2001 From: "Pedro F. Giffuni" Date: Mon, 8 Jul 2013 20:21:36 +0000 Subject: [PATCH] Avoid a panic and return EINVAL instead. Merge from UFS r232692: syscall() fuzzing can trigger this panic. MFC after: 3 days --- sys/fs/ext2fs/ext2_vnops.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sys/fs/ext2fs/ext2_vnops.c b/sys/fs/ext2fs/ext2_vnops.c index 0041e12adb2..dc71696e319 100644 --- a/sys/fs/ext2fs/ext2_vnops.c +++ b/sys/fs/ext2fs/ext2_vnops.c @@ -1598,11 +1598,11 @@ ext2_read(struct vop_read_args *ap) } else if (vp->v_type != VREG && vp->v_type != VDIR) panic("%s: type %d", "ext2_read", vp->v_type); #endif + if (uio->uio_resid < 0 || uio->uio_offset < 0) + return (EINVAL); orig_resid = uio->uio_resid; - KASSERT(orig_resid >= 0, ("ext2_read: uio->uio_resid < 0")); if (orig_resid == 0) return (0); - KASSERT(uio->uio_offset >= 0, ("ext2_read: uio->uio_offset < 0")); fs = ip->i_e2fs; if (uio->uio_offset < ip->i_size && uio->uio_offset >= fs->e2fs_maxfilesize) -- 2.45.0