OS-4292 lx brand: no synchronization with respect to lxpr_cons_ldih

OS-4296 lx brand: lxpr_readdir_*() variants suffer from signed comparisons

1 files changed, 13 insertions, 13 deletions

diff --git a/usr/src/uts/common/fs/lxproc/lxpr_vnops.c b/usr/src/uts/common/fs/lxproc/lxpr_vnops.c
index 7e11b5ce76..48f4efc1bf 100644
--- a/usr/src/uts/common/fs/lxproc/lxpr_vnops.c
+++ b/usr/src/uts/common/fs/lxproc/lxpr_vnops.c
@@ -121,7 +121,7 @@ static void lxpr_read_empty(lxpr_node_t *, lxpr_uiobuf_t *);
 static void lxpr_read_cpuinfo(lxpr_node_t *, lxpr_uiobuf_t *);
 static void lxpr_read_isdir(lxpr_node_t *, lxpr_uiobuf_t *);
 static void lxpr_read_fd(lxpr_node_t *, lxpr_uiobuf_t *);
-static void lxpr_read_kmsg(lxpr_node_t *, lxpr_uiobuf_t *);
+static void lxpr_read_kmsg(lxpr_node_t *, lxpr_uiobuf_t *, ldi_handle_t);
 static void lxpr_read_loadavg(lxpr_node_t *, lxpr_uiobuf_t *);
 static void lxpr_read_meminfo(lxpr_node_t *, lxpr_uiobuf_t *);
 static void lxpr_read_mounts(lxpr_node_t *, lxpr_uiobuf_t *);
@@ -456,7 +456,7 @@ static void (*lxpr_read_function[LXPR_NFILES])() = {
 	lxpr_read_empty,		/* /proc/interrupts	*/
 	lxpr_read_empty,		/* /proc/ioports	*/
 	lxpr_read_empty,		/* /proc/kcore		*/
-	lxpr_read_kmsg,			/* /proc/kmsg		*/
+	lxpr_read_invalid,		/* /proc/kmsg -- see lxpr_read() */
 	lxpr_read_loadavg,		/* /proc/loadavg	*/
 	lxpr_read_meminfo,		/* /proc/meminfo	*/
 	lxpr_read_mounts,		/* /proc/mounts		*/
@@ -622,6 +622,7 @@ lxpr_read(vnode_t *vp, uio_t *uiop, int ioflag, cred_t *cr,
 
 	if (type == LXPR_KMSG) {
 		ldi_ident_t	li = VTOLXPM(vp)->lxprm_li;
+		ldi_handle_t	ldih;
 		struct strioctl	str;
 		int		rv;
 
@@ -629,8 +630,8 @@ lxpr_read(vnode_t *vp, uio_t *uiop, int ioflag, cred_t *cr,
 		 * Open the zone's console device using the layered driver
 		 * interface.
 		 */
-		if ((error = ldi_open_by_name("/dev/log", FREAD, cr,
-		    &lxpnp->lxpr_cons_ldih, li)) != 0)
+		if ((error =
+		    ldi_open_by_name("/dev/log", FREAD, cr, &ldih, li)) != 0)
 			return (error);
 
 		/*
@@ -641,16 +642,16 @@ lxpr_read(vnode_t *vp, uio_t *uiop, int ioflag, cred_t *cr,
 		str.ic_timout = 0;
 		str.ic_len = 0;
 		str.ic_dp = NULL;
-		if ((error = ldi_ioctl(lxpnp->lxpr_cons_ldih, I_STR,
+		if ((error = ldi_ioctl(ldih, I_STR,
 		    (intptr_t)&str, FKIOCTL, cr, &rv)) != 0)
 			return (error);
-	}
 
-	lxpr_read_function[type](lxpnp, uiobuf);
+		lxpr_read_kmsg(lxpnp, uiobuf, ldih);
 
-	if (type == LXPR_KMSG) {
-		if ((error = ldi_close(lxpnp->lxpr_cons_ldih, FREAD, cr)) != 0)
+		if ((error = ldi_close(ldih, FREAD, cr)) != 0)
 			return (error);
+	} else {
+		lxpr_read_function[type](lxpnp, uiobuf);
 	}
 
 	error = lxpr_uiobuf_flush(uiobuf);
@@ -1339,9 +1340,8 @@ lxpr_read_net_unix(lxpr_node_t *lxpnp, lxpr_uiobuf_t *uiobuf)
 #define	LX_KMSG_PRI	"<0>"
 
 static void
-lxpr_read_kmsg(lxpr_node_t *lxpnp, struct lxpr_uiobuf *uiobuf)
+lxpr_read_kmsg(lxpr_node_t *lxpnp, struct lxpr_uiobuf *uiobuf, ldi_handle_t lh)
 {
-	ldi_handle_t	lh = lxpnp->lxpr_cons_ldih;
 	mblk_t		*mp;
 
 	ASSERT(lxpnp->lxpr_type == LXPR_KMSG);
@@ -2749,7 +2749,7 @@ lxpr_readdir_procdir(lxpr_node_t *lxpnp, uio_t *uiop, int *eofp)
 		 * Stop when entire proc table has been examined.
 		 */
 		i = (uoffset / LXPR_SDSIZE) - 2 - PROCDIRFILES;
-		if (i >= v.v_proc) {
+		if (i < 0 || i >= v.v_proc) {
 			/* Run out of table entries */
 			if (eofp) {
 				*eofp = 1;
@@ -2929,7 +2929,7 @@ lxpr_readdir_fddir(lxpr_node_t *lxpnp, uio_t *uiop, int *eofp)
 		 * Stop at the end of the fd list
 		 */
 		fd = (uoffset / LXPR_SDSIZE) - 2;
-		if (fd >= fddirsize) {
+		if (fd < 0 || fd >= fddirsize) {
 			if (eofp) {
 				*eofp = 1;
 			}