HomeFreeBSD

The struct file f_advice member is overlaid with the devfs f_cdevpriv

Description

The struct file f_advice member is overlaid with the devfs f_cdevpriv
data. If vnode bypass for devfs file failed, vn_read/vn_write are
called and might try to dereference f_advice. Limit the accesses to
f_advice to VREG vnodes only, which is the type ensured by
posix_fadvise().

The f_advice for regular files is protected by mtxpool lock. Recheck
that f_advice is not NULL after lock is taken.

Reported and tested by: bde
Sponsored by: The FreeBSD Foundation
MFC after: 3 weeks

Details

Provenance
kibAuthored on
Parents
rS294595: When devfs dirent is freed, a vnode might still keep a pointer to it,
Branches
Unknown
Tags
Unknown