gfapi: Check the fd argument before accessing it

Some public GFAPI functions did access the fd object without verifying
that it wasn't NULL, causing crashes in some cases.

This patch returns an error code in case it's NULL.

Updates: #1009
Change-Id: I8cadde87ae8d542e0af9b55aa866fe763f97d4fb
Signed-off-by: Xavi Hernandez <xhernandez@redhat.com>

2 files changed, 75 insertions, 0 deletions

diff --git a/api/src/glfs-fops.c b/api/src/glfs-fops.c
index fc2cfa04309..6aa3c5602d1 100644
--- a/api/src/glfs-fops.c
+++ b/api/src/glfs-fops.c
@@ -1100,6 +1100,11 @@ pub_glfs_read(struct glfs_fd *glfd, void *buf, size_t count, int flags)
     };
     ssize_t ret = 0;
 
+    if (glfd == NULL) {
+        errno = EBADF;
+        return -1;
+    }
+
     iov.iov_base = buf;
     iov.iov_len = count;
 
@@ -1151,6 +1156,11 @@ pub_glfs_readv(struct glfs_fd *glfd, const struct iovec *iov, int count,
 {
     ssize_t ret = 0;
 
+    if (glfd == NULL) {
+        errno = EBADF;
+        return -1;
+    }
+
     ret = pub_glfs_preadv(glfd, iov, count, glfd->offset, flags);
 
     return ret;
@@ -1387,6 +1397,11 @@ pub_glfs_read_async34(struct glfs_fd *glfd, void *buf, size_t count, int flags,
     };
     ssize_t ret = 0;
 
+    if (glfd == NULL) {
+        errno = EBADF;
+        return -1;
+    }
+
     iov.iov_base = buf;
     iov.iov_len = count;
 
@@ -1406,6 +1421,11 @@ pub_glfs_read_async(struct glfs_fd *glfd, void *buf, size_t count, int flags,
     };
     ssize_t ret = 0;
 
+    if (glfd == NULL) {
+        errno = EBADF;
+        return -1;
+    }
+
     iov.iov_base = buf;
     iov.iov_len = count;
 
@@ -1460,6 +1480,11 @@ pub_glfs_readv_async34(struct glfs_fd *glfd, const struct iovec *iov, int count,
 {
     ssize_t ret = 0;
 
+    if (glfd == NULL) {
+        errno = EBADF;
+        return -1;
+    }
+
     ret = glfs_preadv_async_common(glfd, iov, count, glfd->offset, flags,
                                    _gf_true, (void *)fn, data);
     return ret;
@@ -1472,6 +1497,11 @@ pub_glfs_readv_async(struct glfs_fd *glfd, const struct iovec *iov, int count,
 {
     ssize_t ret = 0;
 
+    if (glfd == NULL) {
+        errno = EBADF;
+        return -1;
+    }
+
     ret = glfs_preadv_async_common(glfd, iov, count, glfd->offset, flags,
                                    _gf_false, fn, data);
     return ret;
@@ -1733,6 +1763,11 @@ pub_glfs_write(struct glfs_fd *glfd, const void *buf, size_t count, int flags)
     };
     ssize_t ret = 0;
 
+    if (glfd == NULL) {
+        errno = EBADF;
+        return -1;
+    }
+
     iov.iov_base = (void *)buf;
     iov.iov_len = count;
 
@@ -1748,6 +1783,11 @@ pub_glfs_writev(struct glfs_fd *glfd, const struct iovec *iov, int count,
 {
     ssize_t ret = 0;
 
+    if (glfd == NULL) {
+        errno = EBADF;
+        return -1;
+    }
+
     ret = pub_glfs_pwritev(glfd, iov, count, glfd->offset, flags);
 
     return ret;
@@ -1938,6 +1978,11 @@ pub_glfs_write_async34(struct glfs_fd *glfd, const void *buf, size_t count,
     };
     ssize_t ret = 0;
 
+    if (glfd == NULL) {
+        errno = EBADF;
+        return -1;
+    }
+
     iov.iov_base = (void *)buf;
     iov.iov_len = count;
 
@@ -1957,6 +2002,11 @@ pub_glfs_write_async(struct glfs_fd *glfd, const void *buf, size_t count,
     };
     ssize_t ret = 0;
 
+    if (glfd == NULL) {
+        errno = EBADF;
+        return -1;
+    }
+
     iov.iov_base = (void *)buf;
     iov.iov_len = count;
 
@@ -2011,6 +2061,11 @@ pub_glfs_writev_async34(struct glfs_fd *glfd, const struct iovec *iov,
 {
     ssize_t ret = 0;
 
+    if (glfd == NULL) {
+        errno = EBADF;
+        return -1;
+    }
+
     ret = glfs_pwritev_async_common(glfd, iov, count, glfd->offset, flags,
                                     _gf_true, (void *)fn, data);
     return ret;
@@ -2023,6 +2078,11 @@ pub_glfs_writev_async(struct glfs_fd *glfd, const struct iovec *iov, int count,
 {
     ssize_t ret = 0;
 
+    if (glfd == NULL) {
+        errno = EBADF;
+        return -1;
+    }
+
     ret = glfs_pwritev_async_common(glfd, iov, count, glfd->offset, flags,
                                     _gf_false, fn, data);
     return ret;
@@ -3334,6 +3394,11 @@ GFAPI_SYMVER_PUBLIC_DEFAULT(glfs_telldir, 3.4.0)
 long
 pub_glfs_telldir(struct glfs_fd *fd)
 {
+    if (fd == NULL) {
+        errno = EBADF;
+        return -1;
+    }
+
     return fd->offset;
 }
 
@@ -3344,6 +3409,11 @@ pub_glfs_seekdir(struct glfs_fd *fd, long offset)
     gf_dirent_t *entry = NULL;
     gf_dirent_t *tmp = NULL;
 
+    if (fd == NULL) {
+        errno = EBADF;
+        return;
+    }
+
     if (fd->offset == offset)
         return;
 
diff --git a/api/src/glfs.c b/api/src/glfs.c
index 5259356b4c5..e4e6ad69fd0 100644
--- a/api/src/glfs.c
+++ b/api/src/glfs.c
@@ -650,6 +650,11 @@ GFAPI_SYMVER_PUBLIC_DEFAULT(glfs_from_glfd, 3.4.0)
 struct glfs *
 pub_glfs_from_glfd(struct glfs_fd *glfd)
 {
+    if (glfd == NULL) {
+        errno = EBADF;
+        return NULL;
+    }
+
     return glfd->fs;
 }