svn commit: r315462 - stable/11/sys/kern

[Mahdi Mokhtari]

Author: mmokhi (ports committer)
Date: Fri Mar 17 21:03:54 2017
New Revision: 315462
URL: https://svnweb.freebsd.org/changeset/base/315462

Log:
  MFC r314996
  Fix NULL pointer dereference and panic with shm file pread/pwrite.
  
  Approved by:	dchagin

Modified:
  stable/11/sys/kern/sys_generic.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/sys/kern/sys_generic.c
==============================================================================
--- stable/11/sys/kern/sys_generic.c	Fri Mar 17 18:08:36 2017	(r315461)
+++ stable/11/sys/kern/sys_generic.c	Fri Mar 17 21:03:54 2017	(r315462)
@@ -336,7 +336,8 @@ kern_preadv(td, fd, auio, offset)
 		return (error);
 	if (!(fp->f_ops->fo_flags & DFLAG_SEEKABLE))
 		error = ESPIPE;
-	else if (offset < 0 && fp->f_vnode->v_type != VCHR)
+	else if (offset < 0 &&
+	    (fp->f_vnode == NULL || fp->f_vnode->v_type != VCHR))
 		error = EINVAL;
 	else
 		error = dofileread(td, fd, fp, auio, offset, FOF_OFFSET);
@@ -551,7 +552,8 @@ kern_pwritev(td, fd, auio, offset)
 		return (error);
 	if (!(fp->f_ops->fo_flags & DFLAG_SEEKABLE))
 		error = ESPIPE;
-	else if (offset < 0 && fp->f_vnode->v_type != VCHR)
+	else if (offset < 0 &&
+	    (fp->f_vnode == NULL || fp->f_vnode->v_type != VCHR))
 		error = EINVAL;
 	else
 		error = dofilewrite(td, fd, fp, auio, offset, FOF_OFFSET);