d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix refcount leaks in the SGX Linux compat ioctl handler.

Browse Source 
Some argument validation error paths would return without releasing the
file reference obtained at the beginning of the function.

While here, fix some style bugs and remove trivial debug prints.

Reviewed by:	kib
MFC after:	1 week
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D19214
This commit is contained in:
Mark Johnston 2019-02-17 16:43:44 +00:00
parent 602566044a
commit 8cbc89c7d2
1 changed files with 9 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
sys/amd64/sgx/sgx_linux.c
View File

@ -70,30 +70,26 @@ sgx_linux_ioctl(struct thread *td, struct linux_ioctl_args *args)
cmd = args->cmd;
args->cmd &= ~(LINUX_IOC_IN | LINUX_IOC_OUT);
if (cmd & LINUX_IOC_IN)
if ((cmd & LINUX_IOC_IN) != 0)
args->cmd |= IOC_IN;
if (cmd & LINUX_IOC_OUT)
if ((cmd & LINUX_IOC_OUT) != 0)
args->cmd |= IOC_OUT;
len = IOCPARM_LEN(cmd);
if (len > SGX_IOCTL_MAX_DATA_LEN) {
printf("%s: Can't copy data: cmd len is too big %d\n",
__func__, len);
return (EINVAL);
error = EINVAL;
goto out;
}
if (cmd & LINUX_IOC_IN) {
if ((cmd & LINUX_IOC_IN) != 0) {
error = copyin((void *)args->arg, data, len);
if (error) {
printf("%s: Can't copy data, error %d\n",
__func__, error);
return (EINVAL);
}
if (error != 0)
goto out;
}
error = (fo_ioctl(fp, args->cmd, (caddr_t)data, td->td_ucred, td));
error = fo_ioctl(fp, args->cmd, (caddr_t)data, td->td_ucred, td);
out:
fdrop(fp, td);
return (error);
}