[net.bugs.4bsd] kernel bug in flock

mccallum@nbires.UUCP (Doug McCallum) (04/09/84)

Subject: flock panics kernel when given invalid parameter
Index:	sys/sys/kern_descrip.c 4.2BSD

Description:
	The flock system call can cause the 4.2 kernel to panic when
	given an invalid second parameter.  This occurs only when the
	file in question is already locked with LOCK_SH and a second
	call to flock where the second parameter does not contain any
	of (LOCK_UN|LOCK_EX|LOCK_SH) set.

Repeat-By:
	The problem can be shown with:
		...
	flock(fd, LOCK_SH);
		...
	flock(fd, 0);
		...

Fix:
	The following context diff of kern_descrip.c prevents the panics:


*** kern_descrip.c	Mon Apr  9 08:16:14 1984
--- /sys/sys/kern_descrip.c	Wed Mar 28 14:35:47 1984
***************
*** 405,414
  		u.u_error = EOPNOTSUPP;
  		return;
  	}
- 	if ((uap->how & (LOCK_UN|LOCK_EX|LOCK_SH){
- 		u.u_error = EINVAL;			/* ??? */
- 		return;
- 	}
  	if (uap->how & LOCK_UN) {
  		ino_unlock(fp, FSHLOCK|FEXLOCK);
  		return;

--- 405,410 -----
  		u.u_error = EOPNOTSUPP;
  		return;
  	}
  	if (uap->how & LOCK_UN) {
  		ino_unlock(fp, FSHLOCK|FEXLOCK);
  		return;

mccallum@nbires.UUCP (Doug McCallum) (04/12/84)

There was a major bug in my last fix.  The typo should have
given a clue.  The following is the correct bug report:

Subject: flock panics kernel when given invalid parameter
Index:	sys/sys/kern_descrip.c 4.2BSD

Description:
	The flock system call can cause the 4.2 kernel to panic when
	given an invalid second parameter.  This occurs only when the
	file in question is already locked with LOCK_SH and a second
	call to flock where the second parameter does not contain any
	of (LOCK_UN|LOCK_EX|LOCK_SH) set.

Repeat-By:
	The problem can be shown with:
		...
	flock(fd, LOCK_SH);
		...
	flock(fd, 0);
		...

Fix:
	The following context diff of kern_descrip.c prevents the panics:


*** kern_descrip.c	Mon Apr  9 08:16:14 1984
--- /sys/sys/kern_descrip.c	Wed Mar 28 14:35:47 1984
***************
*** 405,414
  		u.u_error = EOPNOTSUPP;
  		return;
  	}
- 	if ((uap->how & (LOCK_UN|LOCK_EX|LOCK_SH)) == 0){
- 		u.u_error = EINVAL;			/* ??? */
- 		return;
- 	}
  	if (uap->how & LOCK_UN) {
  		ino_unlock(fp, FSHLOCK|FEXLOCK);
  		return;

--- 405,410 -----
  		u.u_error = EOPNOTSUPP;
  		return;
  	}
  	if (uap->how & LOCK_UN) {
  		ino_unlock(fp, FSHLOCK|FEXLOCK);
  		return;


----------
	Doug McCallum
	{ucbvax,allegra,amd70,hao}!nbires!mccallum