svn commit: r314996 - head/sys/kern

[Mahdi Mokhtari]

Author: mmokhi (ports committer)
Date: Fri Mar 10 10:09:44 2017
New Revision: 314996
URL: https://svnweb.freebsd.org/changeset/base/314996

Log:
  Fix NULL pointer dereference and panic with shm file pread/pwrite.
  
  PR:		217429
  Reported by:	Tim Newsham <tim.newsham at nccgroup.trust>
  Reviewed by:	kib
  Approved by:	dchagin
  MFC after:	1 week
  Differential Revision:	https://reviews.freebsd.org/D9844

Modified:
  head/sys/kern/sys_generic.c

Modified: head/sys/kern/sys_generic.c
==============================================================================
--- head/sys/kern/sys_generic.c	Fri Mar 10 09:58:10 2017	(r314995)
+++ head/sys/kern/sys_generic.c	Fri Mar 10 10:09:44 2017	(r314996)
@@ -334,7 +334,8 @@ kern_preadv(td, fd, auio, offset)
 		return (error);
 	if (!(fp->f_ops->fo_flags & DFLAG_SEEKABLE))
 		error = ESPIPE;
-	else if (offset < 0 && fp->f_vnode->v_type != VCHR)
+	else if (offset < 0 &&
+	    (fp->f_vnode == NULL || fp->f_vnode->v_type != VCHR))
 		error = EINVAL;
 	else
 		error = dofileread(td, fd, fp, auio, offset, FOF_OFFSET);
@@ -548,7 +549,8 @@ kern_pwritev(td, fd, auio, offset)
 		return (error);
 	if (!(fp->f_ops->fo_flags & DFLAG_SEEKABLE))
 		error = ESPIPE;
-	else if (offset < 0 && fp->f_vnode->v_type != VCHR)
+	else if (offset < 0 &&
+	    (fp->f_vnode == NULL || fp->f_vnode->v_type != VCHR))
 		error = EINVAL;
 	else
 		error = dofilewrite(td, fd, fp, auio, offset, FOF_OFFSET);