diff options
| author | Ted Unangst <tedu@cvs.openbsd.org> | 2019-01-22 20:39:52 +0000 |
|---|---|---|
| committer | Ted Unangst <tedu@cvs.openbsd.org> | 2019-01-22 20:39:52 +0000 |
| commit | 312c1233ddbc0bceb194c5d5976fc97b03725d3c (patch) | |
| tree | c6b0ecc1e2379a01fa3b6d8810b88035de8c62db /sys/kern | |
| parent | a6c5dd3bfdea1d7f141a3628b81326726730e664 (diff) | |
namei can return a null dvp on success. check this before access.
ok beck
Reported-by: syzbot+cc59412ed8429450a1ae@syzkaller.appspotmail.com
Diffstat (limited to 'sys/kern')
| -rw-r--r-- | sys/kern/vfs_syscalls.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/sys/kern/vfs_syscalls.c b/sys/kern/vfs_syscalls.c index 67968025326..717bf06185d 100644 --- a/sys/kern/vfs_syscalls.c +++ b/sys/kern/vfs_syscalls.c @@ -1,4 +1,4 @@ -/* $OpenBSD: vfs_syscalls.c,v 1.311 2019/01/21 20:46:52 tedu Exp $ */ +/* $OpenBSD: vfs_syscalls.c,v 1.312 2019/01/22 20:39:51 tedu Exp $ */ /* $NetBSD: vfs_syscalls.c,v 1.71 1996/04/23 10:29:02 mycroft Exp $ */ /* @@ -922,9 +922,10 @@ sys_unveil(struct proc *p, void *v, register_t *retval) (VOP_ACCESS(nd.ni_vp, VREAD, p->p_ucred, p) == 0 || VOP_ACCESS(nd.ni_vp, VWRITE, p->p_ucred, p) == 0 || VOP_ACCESS(nd.ni_vp, VEXEC, p->p_ucred, p) == 0)) || - VOP_ACCESS(nd.ni_dvp, VREAD, p->p_ucred, p) == 0 || + (nd.ni_dvp && + (VOP_ACCESS(nd.ni_dvp, VREAD, p->p_ucred, p) == 0 || VOP_ACCESS(nd.ni_dvp, VWRITE, p->p_ucred, p) == 0 || - VOP_ACCESS(nd.ni_dvp, VEXEC, p->p_ucred, p) == 0); + VOP_ACCESS(nd.ni_dvp, VEXEC, p->p_ucred, p) == 0))); /* release lock from namei, but keep ref */ if (nd.ni_vp) |