⬢ DragonFlyBSD Kernel Audit
DF-2731 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
diff -ru a/sys/kern/sys_generic.c b/sys/kern/sys_generic.c
--- a/sys/kern/sys_generic.c	2026-08-31 10:52:06.653685962 +0000
+++ b/sys/kern/sys_generic.c	2026-08-31 10:52:35.625315618 +0000
@@ -160,6 +160,8 @@
 
 	if ((ssize_t)uap->nbyte < 0)
 		return(EINVAL);
+	if (uap->offset < (off_t)-1)
+		return(EINVAL);
 
 	aiov.iov_base = uap->buf;
 	aiov.iov_len = uap->nbyte;
@@ -224,6 +226,8 @@
 	int error;
 	int flags;
 
+	if (uap->offset < (off_t)-1)
+		return (EINVAL);
 	error = iovec_copyin(uap->iovp, &iov, aiov, uap->iovcnt,
 			     &auio.uio_resid);
 	if (error)
@@ -367,6 +371,8 @@
 
 	if ((ssize_t)uap->nbyte < 0)
 		error = EINVAL;
+	if (uap->offset < (off_t)-1)
+		return(EINVAL);
 
 	aiov.iov_base = (void *)(uintptr_t)uap->buf;
 	aiov.iov_len = uap->nbyte;
@@ -428,6 +434,8 @@
 	int error;
 	int flags;
 
+	if (uap->offset < (off_t)-1)
+		return (EINVAL);
 	error = iovec_copyin(uap->iovp, &iov, aiov, uap->iovcnt,
 			     &auio.uio_resid);
 	if (error)
diff -ru a/sys/vfs/ext2fs/ext2_vnops.c b/sys/vfs/ext2fs/ext2_vnops.c
--- a/sys/vfs/ext2fs/ext2_vnops.c	2026-08-31 10:52:06.657685910 +0000
+++ b/sys/vfs/ext2fs/ext2_vnops.c	2026-08-31 10:52:41.105245571 +0000
@@ -1839,7 +1839,8 @@
 	KASSERT(orig_resid >= 0, ("ext2_read: uio->uio_resid < 0"));
 	if (orig_resid == 0)
 		return (0);
-	KASSERT(uio->uio_offset >= 0, ("ext2_read: uio->uio_offset < 0"));
+	if (uio->uio_offset < 0)
+		return (EINVAL);
 	fs = ip->i_e2fs;
 	if (uio->uio_offset < ip->i_size &&
 	    uio->uio_offset >= fs->e2fs_maxfilesize)
@@ -1977,7 +1978,8 @@
 	}
 
 	KASSERT(uio->uio_resid >= 0, ("ext2_write: uio->uio_resid < 0"));
-	KASSERT(uio->uio_offset >= 0, ("ext2_write: uio->uio_offset < 0"));
+	if (uio->uio_offset < 0)
+		return (EINVAL);
 	fs = ip->i_e2fs;
 	if ((uoff_t)uio->uio_offset + uio->uio_resid > fs->e2fs_maxfilesize)
 		return (EFBIG);