diff options
| author |   tedu <tedu@openbsd.org> | 2019-01-22 20:39:51 +0000 |
|---|---|---|
| committer | tedu <tedu@openbsd.org> | 2019-01-22 20:39:51 +0000 |
| commit | 7fe9ad047fbb497796939c9215badbd50b17ecdd (patch) | |
| tree | 9070d3df339e3169b65316a0b45cdae3b88bbf08 | |
| parent | Do not leak received mbufs if the NDIS appended a zero-byte padding. (diff) | |
| download | wireguard-openbsd-7fe9ad047fbb497796939c9215badbd50b17ecdd.tar.xz wireguard-openbsd-7fe9ad047fbb497796939c9215badbd50b17ecdd.zip | |
namei can return a null dvp on success. check this before access.
ok beck
Reported-by: syzbot+cc59412ed8429450a1ae@syzkaller.appspotmail.com
| -rw-r--r-- | sys/kern/vfs_syscalls.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/sys/kern/vfs_syscalls.c b/sys/kern/vfs_syscalls.c index 67968025326..717bf06185d 100644 --- a/sys/kern/vfs_syscalls.c +++ b/sys/kern/vfs_syscalls.c @@ -1,4 +1,4 @@ -/* $OpenBSD: vfs_syscalls.c,v 1.311 2019/01/21 20:46:52 tedu Exp $ */ +/* $OpenBSD: vfs_syscalls.c,v 1.312 2019/01/22 20:39:51 tedu Exp $ */ /* $NetBSD: vfs_syscalls.c,v 1.71 1996/04/23 10:29:02 mycroft Exp $ */ /* @@ -922,9 +922,10 @@ sys_unveil(struct proc *p, void *v, register_t *retval) (VOP_ACCESS(nd.ni_vp, VREAD, p->p_ucred, p) == 0 || VOP_ACCESS(nd.ni_vp, VWRITE, p->p_ucred, p) == 0 || VOP_ACCESS(nd.ni_vp, VEXEC, p->p_ucred, p) == 0)) || - VOP_ACCESS(nd.ni_dvp, VREAD, p->p_ucred, p) == 0 || + (nd.ni_dvp && + (VOP_ACCESS(nd.ni_dvp, VREAD, p->p_ucred, p) == 0 || VOP_ACCESS(nd.ni_dvp, VWRITE, p->p_ucred, p) == 0 || - VOP_ACCESS(nd.ni_dvp, VEXEC, p->p_ucred, p) == 0); + VOP_ACCESS(nd.ni_dvp, VEXEC, p->p_ucred, p) == 0))); /* release lock from namei, but keep ref */ if (nd.ni_vp) |