Hi, I was looking at readlink syscall. There is the following function in kern/vfs_syscalls.c:
int doreadlinkat(struct proc *p, int fd, const char *path, char *buf, size_t count, register_t *retval) { struct vnode *vp; struct iovec aiov; struct uio auio; int error; struct nameidata nd; NDINITAT(&nd, LOOKUP, NOFOLLOW | LOCKLEAF, UIO_USERSPACE, fd, path, p); if ((error = namei(&nd)) != 0) return (error); vp = nd.ni_vp; if (vp->v_type != VLNK) error = EINVAL; else { aiov.iov_base = buf; aiov.iov_len = count; auio.uio_iov = &aiov; auio.uio_iovcnt = 1; auio.uio_offset = 0; auio.uio_rw = UIO_READ; auio.uio_segflg = UIO_USERSPACE; auio.uio_procp = p; auio.uio_resid = count; error = VOP_READLINK(vp, &auio, p->p_ucred); } vput(vp); *retval = count - auio.uio_resid; return (error); } Hum here, if vp->v_type != VLNK, auio is untouched, but before returning we use auio.uio_resid, which is not initialized. Is it?