Subject: kern/3122: bad error handling in libsa/open.c
To: None <>
From: Matthias Drochner <>
List: netbsd-bugs
Date: 01/17/1997 18:29:02
>Number:         3122
>Category:       kern
>Synopsis:       NULL pointer dereference on open error in F_NODEV case
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people (Kernel Bug People)
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Jan 17 10:20:05 1997
>Originator:     Matthias Drochner
		KFA Juelich	
>Release:        current
	NetBSD-current / libsa
System: NetBSD zelz26 1.2 NetBSD 1.2 (TULIP) #21: Thu Nov 14 22:05:19 MET 1996 drochner@zelz28:/home/drochner/netbsd/sys/arch/i386/compile/TULIP i386

	If an error occurs in the filesystem open function, and the F_NODEV
flag was set in devopen(), a NULL pointer will be called.
(devopen() is obviously not supposed to set the f_dev field in the F_NODEV case.
Compare with close() which does even more checks than necessary!)
*** 119,125 ****
  	if (!error)
  		error = ENOENT;
! 	f->f_dev->dv_close(f);
  	f->f_flags = 0;
  	errno = error;
--- 119,126 ----
  	if (!error)
  		error = ENOENT;
! 	if(!(f->f_flags & F_NODEV))
! 	        f->f_dev->dv_close(f);
  	f->f_flags = 0;
  	errno = error;