svn commit: r320108 - head/sys/kern

[Konstantin Belousov]

Author: kib
Date: Mon Jun 19 15:17:17 2017
New Revision: 320108
URL: https://svnweb.freebsd.org/changeset/base/320108

Log:
  Allow negative aio_offset only for the read and write LIO ops on
  device nodes.
  
  Otherwise, the current check of aio_offset == -1LL makes it possible
  to pass negative file offsets down to the filesystems. This trips
  assertions and is even unsafe for e.g. FFS which keeps metadata at
  negative offsets.
  
  Reported and tested by:	pho
  Reviewed by:	jhb
  Sponsored by:	The FreeBSD Foundation
  MFC after:	1 week
  Differential revision:	https://reviews.freebsd.org/D11266

Modified:
  head/sys/kern/vfs_aio.c

Modified: head/sys/kern/vfs_aio.c
==============================================================================
--- head/sys/kern/vfs_aio.c	Mon Jun 19 15:16:47 2017	(r320107)
+++ head/sys/kern/vfs_aio.c	Mon Jun 19 15:17:17 2017	(r320108)
@@ -1550,7 +1550,9 @@ aio_aqueue(struct thread *td, struct aiocb *ujob, stru
 		goto aqueue_fail;
 	}
 
-	if (opcode != LIO_SYNC && job->uaiocb.aio_offset == -1LL) {
+	if ((opcode == LIO_READ || opcode == LIO_WRITE) &&
+	    job->uaiocb.aio_offset < 0 &&
+	    (fp->f_vnode == NULL || fp->f_vnode->v_type != VCHR)) {
 		error = EINVAL;
 		goto aqueue_fail;
 	}