diff options
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/fs/nfsclient/nfs_clbio.c | 17 | ||||
| -rw-r--r-- | sys/nfsclient/nfs_bio.c | 17 |
2 files changed, 32 insertions, 2 deletions
diff --git a/sys/fs/nfsclient/nfs_clbio.c b/sys/fs/nfsclient/nfs_clbio.c index d63862e..29edf1c 100644 --- a/sys/fs/nfsclient/nfs_clbio.c +++ b/sys/fs/nfsclient/nfs_clbio.c @@ -820,7 +820,21 @@ do_sync: t_uio->uio_segflg = UIO_SYSSPACE; t_uio->uio_rw = UIO_WRITE; t_uio->uio_td = td; - bcopy(uiop->uio_iov->iov_base, t_iov->iov_base, size); + KASSERT(uiop->uio_segflg == UIO_USERSPACE || + uiop->uio_segflg == UIO_SYSSPACE, + ("nfs_directio_write: Bad uio_segflg")); + if (uiop->uio_segflg == UIO_USERSPACE) { + error = copyin(uiop->uio_iov->iov_base, + t_iov->iov_base, size); + if (error != 0) + goto err_free; + } else + /* + * UIO_SYSSPACE may never happen, but handle + * it just in case it does. + */ + bcopy(uiop->uio_iov->iov_base, t_iov->iov_base, + size); bp->b_flags |= B_DIRECT; bp->b_iocmd = BIO_WRITE; if (cred != NOCRED) { @@ -831,6 +845,7 @@ do_sync: bp->b_caller1 = (void *)t_uio; bp->b_vp = vp; error = ncl_asyncio(nmp, bp, NOCRED, td); +err_free: if (error) { free(t_iov->iov_base, M_NFSDIRECTIO); free(t_iov, M_NFSDIRECTIO); diff --git a/sys/nfsclient/nfs_bio.c b/sys/nfsclient/nfs_bio.c index 4a90ad7..e005fc8 100644 --- a/sys/nfsclient/nfs_bio.c +++ b/sys/nfsclient/nfs_bio.c @@ -814,7 +814,21 @@ do_sync: t_uio->uio_segflg = UIO_SYSSPACE; t_uio->uio_rw = UIO_WRITE; t_uio->uio_td = td; - bcopy(uiop->uio_iov->iov_base, t_iov->iov_base, size); + KASSERT(uiop->uio_segflg == UIO_USERSPACE || + uiop->uio_segflg == UIO_SYSSPACE, + ("nfs_directio_write: Bad uio_segflg")); + if (uiop->uio_segflg == UIO_USERSPACE) { + error = copyin(uiop->uio_iov->iov_base, + t_iov->iov_base, size); + if (error != 0) + goto err_free; + } else + /* + * UIO_SYSSPACE may never happen, but handle + * it just in case it does. + */ + bcopy(uiop->uio_iov->iov_base, t_iov->iov_base, + size); bp->b_flags |= B_DIRECT; bp->b_iocmd = BIO_WRITE; if (cred != NOCRED) { @@ -825,6 +839,7 @@ do_sync: bp->b_caller1 = (void *)t_uio; bp->b_vp = vp; error = nfs_asyncio(nmp, bp, NOCRED, td); +err_free: if (error) { free(t_iov->iov_base, M_NFSDIRECTIO); free(t_iov, M_NFSDIRECTIO); |
