From dcce0dc5f009e8a3ec6dc48f5fc99abc4d74200f Mon Sep 17 00:00:00 2001 From: Richard Yao Date: Mon, 31 Oct 2022 13:01:04 -0400 Subject: [PATCH] Fix oversights from 4170ae4e 4170ae4ea600fea6ac9daa8b145960c9de3915fc was intended to tackle TOCTOU race conditions reported by CodeQL, but as an oversight, a file descriptor was not closed and some comments were not updated. Interestingly, CodeQL did not complain about the file descriptor leak, so there is room for improvement in how we configure it to try to detect this issue so that we get early warning about this. In addition, an optimization opportunity was missed by mistake in lib/libshare/os/linux/smb.c, which prevented us from truly closing the TOCTOU race. This was also caught by Coverity. Reported-by: Coverity (CID 1524424) Reported-by: Coverity (CID 1526804) Reviewed-by: Brian Behlendorf Signed-off-by: Richard Yao Closes #14109 --- lib/libshare/os/linux/smb.c | 2 +- tests/zfs-tests/tests/functional/tmpfile/tmpfile_stat_mode.c | 5 +++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/lib/libshare/os/linux/smb.c b/lib/libshare/os/linux/smb.c index 8eb1894de..0679e8210 100644 --- a/lib/libshare/os/linux/smb.c +++ b/lib/libshare/os/linux/smb.c @@ -103,7 +103,7 @@ smb_retrieve_shares(void) goto out; } - if (stat(file_path, &eStat) == -1) { + if (fstat(fd, &eStat) == -1) { close(fd); rc = SA_SYSTEM_ERR; goto out; diff --git a/tests/zfs-tests/tests/functional/tmpfile/tmpfile_stat_mode.c b/tests/zfs-tests/tests/functional/tmpfile/tmpfile_stat_mode.c index 1a934a8b1..8f936d36d 100644 --- a/tests/zfs-tests/tests/functional/tmpfile/tmpfile_stat_mode.c +++ b/tests/zfs-tests/tests/functional/tmpfile/tmpfile_stat_mode.c @@ -37,12 +37,12 @@ /* * DESCRIPTION: - * Verify stat(2) for O_TMPFILE file considers umask. + * Verify fstat(2) for O_TMPFILE file considers umask. * * STRATEGY: * 1. open(2) with O_TMPFILE. * 2. linkat(2). - * 3. fstat(2)/stat(2) and verify .st_mode value. + * 3. fstat(2) and verify .st_mode value. */ static void @@ -94,6 +94,7 @@ test_stat_mode(mode_t mask) mode = fst.st_mode & 0777; if (mode != masked) errx(8, "fstat(2) %o != %o\n", mode, masked); + close(fd); } int