svn commit: r332638 - stable/11/lib/libufs

[Kirk McKusick]

Author: mckusick
Date: Tue Apr 17 00:03:32 2018
New Revision: 332638
URL: https://svnweb.freebsd.org/changeset/base/332638

Log:
  MFC of 332264, 332266, 332415:
  
  Check for errors in libufs getino() and gracefully fail descriptor
  upgrade request in ufs_disk_write().

Modified:
  stable/11/lib/libufs/inode.c
  stable/11/lib/libufs/type.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/lib/libufs/inode.c
==============================================================================
--- stable/11/lib/libufs/inode.c	Mon Apr 16 21:22:12 2018	(r332637)
+++ stable/11/lib/libufs/inode.c	Tue Apr 17 00:03:32 2018	(r332638)
@@ -58,6 +58,10 @@ getino(struct uufsd *disk, void **dino, ino_t inode, i
 	ERROR(disk, NULL);
 
 	fs = &disk->d_fs;
+	if (inode >= (ino_t)fs->fs_ipg * fs->fs_ncg) {
+		ERROR(disk, "inode number out of range");
+		return (-1);
+	}
 	inoblock = disk->d_inoblock;
 	min = disk->d_inomin;
 	max = disk->d_inomax;
@@ -79,13 +83,17 @@ getino(struct uufsd *disk, void **dino, ino_t inode, i
 gotit:	switch (disk->d_ufs) {
 	case 1:
 		dp1 = &((struct ufs1_dinode *)inoblock)[inode - min];
-		*mode = dp1->di_mode & IFMT;
-		*dino = dp1;
+		if (mode != NULL)
+			*mode = dp1->di_mode & IFMT;
+		if (dino != NULL)
+			*dino = dp1;
 		return (0);
 	case 2:
 		dp2 = &((struct ufs2_dinode *)inoblock)[inode - min];
-		*mode = dp2->di_mode & IFMT;
-		*dino = dp2;
+		if (mode != NULL)
+			*mode = dp2->di_mode & IFMT;
+		if (dino != NULL)
+			*dino = dp2;
 		return (0);
 	default:
 		break;

Modified: stable/11/lib/libufs/type.c
==============================================================================
--- stable/11/lib/libufs/type.c	Mon Apr 16 21:22:12 2018	(r332637)
+++ stable/11/lib/libufs/type.c	Tue Apr 17 00:03:32 2018	(r332638)
@@ -58,6 +58,7 @@ ufs_disk_close(struct uufsd *disk)
 {
 	ERROR(disk, NULL);
 	close(disk->d_fd);
+	disk->d_fd = -1;
 	if (disk->d_inoblock != NULL) {
 		free(disk->d_inoblock);
 		disk->d_inoblock = NULL;
@@ -178,19 +179,21 @@ again:	if ((ret = stat(name, &st)) < 0) {
 int
 ufs_disk_write(struct uufsd *disk)
 {
+	int fd;
+
 	ERROR(disk, NULL);
 
 	if (disk->d_mine & MINE_WRITE)
 		return (0);
 
-	close(disk->d_fd);
-
-	disk->d_fd = open(disk->d_name, O_RDWR);
-	if (disk->d_fd < 0) {
+	fd = open(disk->d_name, O_RDWR);
+	if (fd < 0) {
 		ERROR(disk, "failed to open disk for writing");
 		return (-1);
 	}
 
+	close(disk->d_fd);
+	disk->d_fd = fd;
 	disk->d_mine |= MINE_WRITE;
 
 	return (0);