6940833 vxio`vxioioctl() panics when zfs passes it a NULL rvalp via ldi_ioctl()
authorEric Taylor <Eric.Taylor@Sun.COM>
Thu, 29 Apr 2010 16:02:31 -0600
changeset 12287 afa277cb17b1
parent 12286 2ba5ef27b57b
child 12288 70ddea689280
6940833 vxio`vxioioctl() panics when zfs passes it a NULL rvalp via ldi_ioctl()
usr/src/uts/common/os/driver_lyr.c
--- a/usr/src/uts/common/os/driver_lyr.c	Thu Apr 29 15:16:56 2010 -0600
+++ b/usr/src/uts/common/os/driver_lyr.c	Thu Apr 29 16:02:31 2010 -0600
@@ -19,8 +19,7 @@
  * CDDL HEADER END
  */
 /*
- * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
- * Use is subject to license terms.
+ * Copyright (c) 1994, 2010, Oracle and/or its affiliates. All rights reserved.
  */
 
 /*
@@ -1918,7 +1917,7 @@
 	struct ldi_handle	*handlep = (struct ldi_handle *)lh;
 	vnode_t			*vp;
 	dev_t			dev;
-	int			ret, copymode;
+	int			ret, copymode, unused;
 
 	if (lh == NULL)
 		return (EINVAL);
@@ -1930,6 +1929,13 @@
 	if (mode & FKIOCTL)
 		mode = (mode & ~FMODELS) | FNATIVE | FKIOCTL;
 
+	/*
+	 * Some drivers assume that rvalp will always be non-NULL, so in
+	 * an attempt to avoid panics if the caller passed in a NULL
+	 * value, update rvalp to point to a temporary variable.
+	 */
+	if (rvalp == NULL)
+		rvalp = &unused;
 	vp = handlep->lh_vp;
 	dev = vp->v_rdev;
 	if (handlep->lh_type & LH_CBDEV) {