Hi,
I was looking at readlink syscall. There is the following function in
kern/vfs_syscalls.c:

int
doreadlinkat(struct proc *p, int fd, const char *path, char *buf,
    size_t count, register_t *retval)
{
        struct vnode *vp;
        struct iovec aiov;
        struct uio auio;
        int error;
        struct nameidata nd;

        NDINITAT(&nd, LOOKUP, NOFOLLOW | LOCKLEAF, UIO_USERSPACE, fd, path, p);
        if ((error = namei(&nd)) != 0)
                return (error);
        vp = nd.ni_vp;
        if (vp->v_type != VLNK)
                error = EINVAL;
        else {
                aiov.iov_base = buf;
                aiov.iov_len = count;
                auio.uio_iov = &aiov;
                auio.uio_iovcnt = 1;
                auio.uio_offset = 0;
                auio.uio_rw = UIO_READ;
                auio.uio_segflg = UIO_USERSPACE;
                auio.uio_procp = p;
                auio.uio_resid = count;
                error = VOP_READLINK(vp, &auio, p->p_ucred);
        }
        vput(vp);
        *retval = count - auio.uio_resid;
        return (error);
}

Hum here, if vp->v_type != VLNK, auio is untouched, but before returning
we use auio.uio_resid, which is not initialized. Is it?

Reply via email to