From fd76e780a7c06880c5d629c5ea04fff910fc205d Mon Sep 17 00:00:00 2001 From: Mark Johnston Date: Mon, 25 Mar 2019 21:38:58 +0000 Subject: [PATCH] Reject F_SETLK_REMOTE commands when sysid == 0. A sysid of 0 denotes the local system, and some handlers for remote locking commands do not attempt to deal with local locks. Note that F_SETLK_REMOTE is only available to privileged users as it is intended to be used as a testing interface. Reviewed by: kib Reported by: syzbot+9c457a6ae014a3281eb8@syzkaller.appspotmail.com MFC after: 2 weeks Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D19702 --- sys/kern/kern_descrip.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/sys/kern/kern_descrip.c b/sys/kern/kern_descrip.c index 858f306ef98..3a89053d870 100644 --- a/sys/kern/kern_descrip.c +++ b/sys/kern/kern_descrip.c @@ -601,7 +601,7 @@ kern_fcntl(struct thread *td, int fd, int cmd, intptr_t arg) case F_SETLK_REMOTE: error = priv_check(td, PRIV_NFS_LOCKD); - if (error) + if (error != 0) return (error); flg = F_REMOTE; goto do_setlk; @@ -612,6 +612,12 @@ kern_fcntl(struct thread *td, int fd, int cmd, intptr_t arg) case F_SETLK: do_setlk: + flp = (struct flock *)arg; + if ((flg & F_REMOTE) != 0 && flp->l_sysid == 0) { + error = EINVAL; + break; + } + error = fget_unlocked(fdp, fd, &cap_flock_rights, &fp, NULL); if (error != 0) break; @@ -621,7 +627,6 @@ kern_fcntl(struct thread *td, int fd, int cmd, intptr_t arg) break; } - flp = (struct flock *)arg; if (flp->l_whence == SEEK_CUR) { foffset = foffset_get(fp); if (foffset < 0 || @@ -667,10 +672,6 @@ kern_fcntl(struct thread *td, int fd, int cmd, intptr_t arg) flp, flg); break; case F_UNLCKSYS: - /* - * Temporary api for testing remote lock - * infrastructure. - */ if (flg != F_REMOTE) { error = EINVAL; break;