From 711dba24d73efcfe1fb70d1041a3aef0d1b34083 Mon Sep 17 00:00:00 2001 From: Konstantin Belousov Date: Mon, 19 Jun 2017 15:17:17 +0000 Subject: [PATCH] Allow negative aio_offset only for the read and write LIO ops on device nodes. Otherwise, the current check of aio_offset == -1LL makes it possible to pass negative file offsets down to the filesystems. This trips assertions and is even unsafe for e.g. FFS which keeps metadata at negative offsets. Reported and tested by: pho Reviewed by: jhb Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D11266 --- sys/kern/vfs_aio.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/sys/kern/vfs_aio.c b/sys/kern/vfs_aio.c index c95dc772f52..26027b7d181 100644 --- a/sys/kern/vfs_aio.c +++ b/sys/kern/vfs_aio.c @@ -1550,7 +1550,9 @@ aio_aqueue(struct thread *td, struct aiocb *ujob, struct aioliojob *lj, goto aqueue_fail; } - if (opcode != LIO_SYNC && job->uaiocb.aio_offset == -1LL) { + if ((opcode == LIO_READ || opcode == LIO_WRITE) && + job->uaiocb.aio_offset < 0 && + (fp->f_vnode == NULL || fp->f_vnode->v_type != VCHR)) { error = EINVAL; goto aqueue_fail; }