Similar to other diffs, this one move a FREF() right after fd_getfile_mode(), ok?
Index: kern/sys_generic.c =================================================================== RCS file: /cvs/src/sys/kern/sys_generic.c,v retrieving revision 1.116 diff -u -p -r1.116 sys_generic.c --- kern/sys_generic.c 2 Jan 2018 06:38:45 -0000 1.116 +++ kern/sys_generic.c 3 Apr 2018 13:32:32 -0000 @@ -393,29 +393,30 @@ sys_ioctl(struct proc *p, void *v, regis struct file *fp; struct filedesc *fdp; u_long com = SCARG(uap, com); - int error; + int error = 0; u_int size; - caddr_t data, memp; + caddr_t data, memp = NULL; int tmp; #define STK_PARAMS 128 long long stkbuf[STK_PARAMS / sizeof(long long)]; fdp = p->p_fd; - fp = fd_getfile_mode(fdp, SCARG(uap, fd), FREAD|FWRITE); - - if (fp == NULL) + if ((fp = fd_getfile_mode(fdp, SCARG(uap, fd), FREAD|FWRITE)) == NULL) return (EBADF); + FREF(fp); if (fp->f_type == DTYPE_SOCKET) { struct socket *so = fp->f_data; - if (so->so_state & SS_DNS) - return (EINVAL); + if (so->so_state & SS_DNS) { + error = EINVAL; + goto out; + } } error = pledge_ioctl(p, com, fp); if (error) - return (error); + goto out; switch (com) { case FIONCLEX: @@ -426,7 +427,7 @@ sys_ioctl(struct proc *p, void *v, regis else fdp->fd_ofileflags[SCARG(uap, fd)] |= UF_EXCLOSE; fdpunlock(fdp); - return (0); + goto out; } /* @@ -434,10 +435,10 @@ sys_ioctl(struct proc *p, void *v, regis * copied to/from the user's address space. */ size = IOCPARM_LEN(com); - if (size > IOCPARM_MAX) - return (ENOTTY); - FREF(fp); - memp = NULL; + if (size > IOCPARM_MAX) { + error = ENOTTY; + goto out; + } if (size > sizeof (stkbuf)) { memp = malloc(size, M_IOCTLOPS, M_WAITOK); data = memp; @@ -525,8 +526,7 @@ sys_ioctl(struct proc *p, void *v, regis error = copyout(data, SCARG(uap, data), size); out: FRELE(fp, p); - if (memp) - free(memp, M_IOCTLOPS, size); + free(memp, M_IOCTLOPS, size); return (error); }