d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix refcount leaks in the SGX Linux compat ioctl handler.

Browse Source 
Some argument validation error paths would return without releasing the
file reference obtained at the beginning of the function.

While here, fix some style bugs and remove trivial debug prints.

Reviewed by:	kib
MFC after:	1 week
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D19214
This commit is contained in:
markj 2019-02-17 16:43:44 +00:00
parent 88d649090e
commit 9a26ede14d
1 changed files with 9 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
sys/amd64/sgx/sgx_linux.c
View File

@ -70,30 +70,26 @@ sgx_linux_ioctl(struct thread *td, struct linux_ioctl_args *args)
cmd = args->cmd;
args->cmd &= ~(LINUX_IOC_IN | LINUX_IOC_OUT);
if (cmd & LINUX_IOC_IN)
if ((cmd & LINUX_IOC_IN) != 0)
args->cmd |= IOC_IN;
if (cmd & LINUX_IOC_OUT)
if ((cmd & LINUX_IOC_OUT) != 0)
args->cmd |= IOC_OUT;
len = IOCPARM_LEN(cmd);
if (len > SGX_IOCTL_MAX_DATA_LEN) {
printf("%s: Can't copy data: cmd len is too big %d\n",
__func__, len);
return (EINVAL);
error = EINVAL;
goto out;
}
if (cmd & LINUX_IOC_IN) {
if ((cmd & LINUX_IOC_IN) != 0) {
error = copyin((void *)args->arg, data, len);
if (error) {
printf("%s: Can't copy data, error %d\n",
__func__, error);
return (EINVAL);
}
if (error != 0)
goto out;
}
error = (fo_ioctl(fp, args->cmd, (caddr_t)data, td->td_ucred, td));
error = fo_ioctl(fp, args->cmd, (caddr_t)data, td->td_ucred, td);
out:
fdrop(fp, td);
return (error);
}