From c5047e3d7524777db631ed4cf4ac745f8a95f16b Mon Sep 17 00:00:00 2001 From: kib Date: Sun, 27 Nov 2011 19:02:18 +0000 Subject: [PATCH] MFC r227952: Fix a race between getvnode() dereferencing half-constructed file and dupfdopen(). Approved by: re (bz) git-svn-id: svn://svn.freebsd.org/base/releng/9.0@228035 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f --- sys/kern/vfs_syscalls.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/sys/kern/vfs_syscalls.c b/sys/kern/vfs_syscalls.c index ec5ad061..076c75d0 100644 --- a/sys/kern/vfs_syscalls.c +++ b/sys/kern/vfs_syscalls.c @@ -4342,7 +4342,20 @@ getvnode(struct filedesc *fdp, int fd, cap_rights_t rights, fp = fp_fromcap; } #endif /* CAPABILITIES */ - if (fp->f_vnode == NULL) { + + /* + * The file could be not of the vnode type, or it may be not + * yet fully initialized, in which case the f_vnode pointer + * may be set, but f_ops is still badfileops. E.g., + * devfs_open() transiently create such situation to + * facilitate csw d_fdopen(). + * + * Dupfdopen() handling in kern_openat() installs the + * half-baked file into the process descriptor table, allowing + * other thread to dereference it. Guard against the race by + * checking f_ops. + */ + if (fp->f_vnode == NULL || fp->f_ops == &badfileops) { fdrop(fp, curthread); return (EINVAL); } -- 2.42.0