svn commit: r359272 - head/sys/kern

[Konstantin Belousov]

Author: kib
Date: Tue Mar 24 17:16:52 2020
New Revision: 359272
URL: https://svnweb.freebsd.org/changeset/base/359272

Log:
  kern_copy_file_range(): check the file type.
  
  The syscall can only operate on valid vnode types.
  
  Reported and tested by:	pho
  Sponsored by:	The FreeBSD Foundation

Modified:
  head/sys/kern/vfs_syscalls.c

Modified: head/sys/kern/vfs_syscalls.c
==============================================================================
--- head/sys/kern/vfs_syscalls.c	Tue Mar 24 12:27:02 2020	(r359271)
+++ head/sys/kern/vfs_syscalls.c	Tue Mar 24 17:16:52 2020	(r359272)
@@ -4735,9 +4735,25 @@ kern_copy_file_range(struct thread *td, int infd, off_
 	error = fget_read(td, infd, &cap_read_rights, &infp);
 	if (error != 0)
 		goto out;
+	if (infp->f_ops == &badfileops) {
+		error = EBADF;
+		goto out;
+	}
+	if (infp->f_vnode == NULL) {
+		error = EINVAL;
+		goto out;
+	}
 	error = fget_write(td, outfd, &cap_write_rights, &outfp);
 	if (error != 0)
 		goto out;
+	if (outfp->f_ops == &badfileops) {
+		error = EBADF;
+		goto out;
+	}
+	if (outfp->f_vnode == NULL) {
+		error = EINVAL;
+		goto out;
+	}
 
 	/* Set the offset pointers to the correct place. */
 	if (inoffp == NULL)