svn commit: r315481 - stable/10/sys/kern

[Mahdi Mokhtari]

Author: mmokhi (ports committer)
Date: Sat Mar 18 12:39:24 2017
New Revision: 315481
URL: https://svnweb.freebsd.org/changeset/base/315481

Log:
  MFC r314996:
  Fix NULL pointer dereference and panic with shm file pread/pwrite.
  
  PR:		217429
  Approved by:	dchagin

Modified:
  stable/10/sys/kern/sys_generic.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/sys/kern/sys_generic.c
==============================================================================
--- stable/10/sys/kern/sys_generic.c	Sat Mar 18 11:13:54 2017	(r315480)
+++ stable/10/sys/kern/sys_generic.c	Sat Mar 18 12:39:24 2017	(r315481)
@@ -313,7 +313,8 @@ kern_preadv(td, fd, auio, offset)
 		return (error);
 	if (!(fp->f_ops->fo_flags & DFLAG_SEEKABLE))
 		error = ESPIPE;
-	else if (offset < 0 && fp->f_vnode->v_type != VCHR)
+	else if (offset < 0 &&
+	    (fp->f_vnode == NULL || fp->f_vnode->v_type != VCHR))
 		error = EINVAL;
 	else
 		error = dofileread(td, fd, fp, auio, offset, FOF_OFFSET);
@@ -524,7 +525,8 @@ kern_pwritev(td, fd, auio, offset)
 		return (error);
 	if (!(fp->f_ops->fo_flags & DFLAG_SEEKABLE))
 		error = ESPIPE;
-	else if (offset < 0 && fp->f_vnode->v_type != VCHR)
+	else if (offset < 0 &&
+	    (fp->f_vnode == NULL || fp->f_vnode->v_type != VCHR))
 		error = EINVAL;
 	else
 		error = dofilewrite(td, fd, fp, auio, offset, FOF_OFFSET);