From owner-svn-src-head@freebsd.org  Wed Jul  8 13:19:15 2015
Return-Path: <owner-svn-src-head@freebsd.org>
Delivered-To: svn-src-head@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id 6E9609954FC;
 Wed,  8 Jul 2015 13:19:15 +0000 (UTC) (envelope-from kib@FreeBSD.org)
Received: from repo.freebsd.org (repo.freebsd.org
 [IPv6:2001:1900:2254:2068::e6a:0])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id 561C11309;
 Wed,  8 Jul 2015 13:19:15 +0000 (UTC) (envelope-from kib@FreeBSD.org)
Received: from repo.freebsd.org ([127.0.1.70])
 by repo.freebsd.org (8.14.9/8.14.9) with ESMTP id t68DJE90009894;
 Wed, 8 Jul 2015 13:19:14 GMT (envelope-from kib@FreeBSD.org)
Received: (from kib@localhost)
 by repo.freebsd.org (8.14.9/8.14.9/Submit) id t68DJEYM009891;
 Wed, 8 Jul 2015 13:19:14 GMT (envelope-from kib@FreeBSD.org)
Message-Id: <201507081319.t68DJEYM009891@repo.freebsd.org>
X-Authentication-Warning: repo.freebsd.org: kib set sender to kib@FreeBSD.org
 using -f
From: Konstantin Belousov <kib@FreeBSD.org>
Date: Wed, 8 Jul 2015 13:19:14 +0000 (UTC)
To: src-committers@freebsd.org, svn-src-all@freebsd.org,
 svn-src-head@freebsd.org
Subject: svn commit: r285269 - head/sys/kern
X-SVN-Group: head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-src-head@freebsd.org
X-Mailman-Version: 2.1.20
Precedence: list
List-Id: SVN commit messages for the src tree for head/-current
 <svn-src-head.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/svn-src-head>,
 <mailto:svn-src-head-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-src-head/>
List-Post: <mailto:svn-src-head@freebsd.org>
List-Help: <mailto:svn-src-head-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/svn-src-head>,
 <mailto:svn-src-head-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 08 Jul 2015 13:19:15 -0000

Author: kib
Date: Wed Jul  8 13:19:13 2015
New Revision: 285269
URL: https://svnweb.freebsd.org/changeset/base/285269

Log:
  Handle copyout for the fcntl(F_OGETLK) using oflock structure.
  Otherwise, kernel overwrites a word past the destination.
  
  Submitted by:	walter@pelissero.de
  PR:	196718
  MFC after:	1 week

Modified:
  head/sys/kern/kern_descrip.c

Modified: head/sys/kern/kern_descrip.c
==============================================================================
--- head/sys/kern/kern_descrip.c	Wed Jul  8 12:42:44 2015	(r285268)
+++ head/sys/kern/kern_descrip.c	Wed Jul  8 13:19:13 2015	(r285269)
@@ -404,9 +404,10 @@ kern_fcntl_freebsd(struct thread *td, in
 	struct flock fl;
 	struct __oflock ofl;
 	intptr_t arg1;
-	int error;
+	int error, newcmd;
 
 	error = 0;
+	newcmd = cmd;
 	switch (cmd) {
 	case F_OGETLK:
 	case F_OSETLK:
@@ -424,13 +425,13 @@ kern_fcntl_freebsd(struct thread *td, in
 
 		switch (cmd) {
 		case F_OGETLK:
-			cmd = F_GETLK;
+			newcmd = F_GETLK;
 			break;
 		case F_OSETLK:
-			cmd = F_SETLK;
+			newcmd = F_SETLK;
 			break;
 		case F_OSETLKW:
-			cmd = F_SETLKW;
+			newcmd = F_SETLKW;
 			break;
 		}
 		arg1 = (intptr_t)&fl;
@@ -448,7 +449,7 @@ kern_fcntl_freebsd(struct thread *td, in
 	}
 	if (error)
 		return (error);
-	error = kern_fcntl(td, fd, cmd, arg1);
+	error = kern_fcntl(td, fd, newcmd, arg1);
 	if (error)
 		return (error);
 	if (cmd == F_OGETLK) {