⬢ DragonFlyBSD Kernel Audit
DF-4149 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
--- a/sys/dev/misc/cuse/cuse.c
+++ b/sys/dev/misc/cuse/cuse.c
@@ static int
 cuse_client_read(struct dev_read_args *ap)
 {
@@
 	cuse_cmd_lock(pccmd);
 
 	while (uio->uio_resid != 0) {
+		/* skip empty iovs like uiomove() does, else we spin */
+		while (uio->uio_iovcnt != 0 && uio->uio_iov->iov_len == 0) {
+			uio->uio_iov++;
+			uio->uio_iovcnt--;
+		}
+		if (uio->uio_iovcnt == 0 || uio->uio_resid == 0)
+			break;
 		if (uio->uio_iov->iov_len > CUSE_LENGTH_MAX) {
 			error = ENOMEM;
 			break;
@@ static int
 cuse_client_write(struct dev_write_args *ap)
 {
@@
 	cuse_cmd_lock(pccmd);
 
 	while (uio->uio_resid != 0) {
+		/* skip empty iovs like uiomove() does, else we spin */
+		while (uio->uio_iovcnt != 0 && uio->uio_iov->iov_len == 0) {
+			uio->uio_iov++;
+			uio->uio_iovcnt--;
+		}
+		if (uio->uio_iovcnt == 0 || uio->uio_resid == 0)
+			break;
 		if (uio->uio_iov->iov_len > CUSE_LENGTH_MAX) {
 			error = ENOMEM;
 			break;