svn commit: r219986 - head/sys/compat/freebsd32

[Konstantin Belousov]

Author: kib
Date: Fri Mar 25 10:57:57 2011
New Revision: 219986
URL: http://svn.freebsd.org/changeset/base/219986

Log:
  Fix file leakage in the freebsd32_ioctl routines.
  
  Code inspection shows freebsd32_ioctl calls fget for a fd and calls
  a subroutine to handle each specific ioctl.  It is expected that the
  subroutine will call fdrop when done.  However many of the subroutines
  will exit out early if copyin encounters an error resulting in fdrop
  never being called.
  
  Submitted by: John Wehle <john feith com>
  MFC after:    3 days

Modified:
  head/sys/compat/freebsd32/freebsd32_ioctl.c

Modified: head/sys/compat/freebsd32/freebsd32_ioctl.c
==============================================================================
--- head/sys/compat/freebsd32/freebsd32_ioctl.c Fri Mar 25 10:55:25 2011        
(r219985)
+++ head/sys/compat/freebsd32/freebsd32_ioctl.c Fri Mar 25 10:57:57 2011        
(r219986)
@@ -70,7 +70,6 @@ freebsd32_ioctl_md(struct thread *td, st
                panic("%s: where is my ioctl data??", __func__);
        if (uap->com & IOC_IN) {
                if ((error = copyin(uap->data, &md32, sizeof(md32)))) {
-                       fdrop(fp, td);
                        return (error);
                }
                CP(md32, mdv, md_version);
@@ -121,7 +120,6 @@ freebsd32_ioctl_md(struct thread *td, st
                CP(mdv, md32, md_fwsectors);
                error = copyout(&md32, uap->data, sizeof(md32));
        }
-       fdrop(fp, td);
        return error;
 }
 
@@ -144,7 +142,6 @@ freebsd32_ioctl_ioc_toc_header(struct th
        CP(toch32, toch, ending_track);
        error = fo_ioctl(fp, CDIOREADTOCHEADER, (caddr_t)&toch,
            td->td_ucred, td);
-       fdrop(fp, td);
        return (error);
 }
 
@@ -175,7 +172,6 @@ freebsd32_ioctl_ioc_read_toc(struct thre
                PTROUT_CP(toce, toce32, data);
                error = copyout(&toce32, uap->data, sizeof(toce32));
        }
-       fdrop(fp, td);
        return error;
 }
 
@@ -192,7 +188,6 @@ freebsd32_ioctl_fiodgname(struct thread 
        CP(fgn32, fgn, len);
        PTRIN_CP(fgn32, fgn, buf);
        error = fo_ioctl(fp, FIODGNAME, (caddr_t)&fgn, td->td_ucred, td);
-       fdrop(fp, td);
        return (error);
 }
 
@@ -219,16 +214,20 @@ freebsd32_ioctl(struct thread *td, struc
        case MDIOCDETACH_32:    /* FALLTHROUGH */
        case MDIOCQUERY_32:     /* FALLTHROUGH */
        case MDIOCLIST_32:
-               return freebsd32_ioctl_md(td, uap, fp);
+               error = freebsd32_ioctl_md(td, uap, fp);
+               break;
 
        case CDIOREADTOCENTRYS_32:
-               return freebsd32_ioctl_ioc_read_toc(td, uap, fp);
+               error = freebsd32_ioctl_ioc_read_toc(td, uap, fp);
+               break;
 
        case CDIOREADTOCHEADER_32:
-               return freebsd32_ioctl_ioc_toc_header(td, uap, fp);
+               error = freebsd32_ioctl_ioc_toc_header(td, uap, fp);
+               break;
 
        case FIODGNAME_32:
-               return freebsd32_ioctl_fiodgname(td, uap, fp);
+               error = freebsd32_ioctl_fiodgname(td, uap, fp);
+               break;
 
        default:
                fdrop(fp, td);
@@ -237,4 +236,7 @@ freebsd32_ioctl(struct thread *td, struc
                PTRIN_CP(*uap, ap, data);
                return ioctl(td, &ap);
        }
+
+       fdrop(fp, td);
+       return error;
 }
_______________________________________________
svn-src-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"