kernel: fix null dereference when delegating an nonexistent handle

2 files changed, 27 insertions, 3 deletions

diff --git a/src/cmd/tests/kernel/fs.c b/src/cmd/tests/kernel/fs.c
index 449ed43..6d4f4f4 100644
--- a/src/cmd/tests/kernel/fs.c
+++ b/src/cmd/tests/kernel/fs.c
@@ -77,9 +77,32 @@ static void test_no_fs(void) {
 	test(_sys_fs_wait(buf, 256, &res) == -EPIPE);
 }
 
+/* Tries to delegate a nonexistent handle */
+static void test_bad_delegate(void) {
+	hid_t h = -1;
+	int ret = _sys_fork(FORK_NEWFS, &h);
+	test(0 <= ret);
+	if (ret == 0) {
+		struct ufs_request res;
+		for (;;) {
+			h = _sys_fs_wait(NULL, 0, &res);
+			_sys_close(0);
+			_sys_fs_respond(h, NULL, 0, FSR_DELEGATE);
+		}
+	} else {
+		test(0 <= h);
+		test(_sys_mount(h, "/", 1) == 0);
+		for (int i = 0; i < 4; i++) {
+			int ret = _sys_open("/", 1, 0);
+			test(ret < 0);
+		}
+	}
+}
+
 void r_k_fs(void) {
 	run_test(test_unfinished_req);
 	run_test(test_orphaned_fs);
 	run_test(test_fs_cleanup);
 	run_test(test_no_fs);
+	run_test(test_bad_delegate);
 }
diff --git a/src/kernel/vfs/request.c b/src/kernel/vfs/request.c
index 0c763b3..e3f0316 100644
--- a/src/kernel/vfs/request.c
+++ b/src/kernel/vfs/request.c
@@ -60,9 +60,10 @@ void vfsreq_finish(VfsReq *req, char __user *stored, long ret,
 			/* delegating - moving a handle to the caller */
 			assert(handler);
 			h = hs_take(handler->hs, ret);
-			// TODO!!! no null check
-			h->readable = h->readable && OPEN_READABLE(req->flags);
-			h->writeable = h->writeable && OPEN_WRITEABLE(req->flags);
+			if (h) {
+				h->readable = h->readable && OPEN_READABLE(req->flags);
+				h->writeable = h->writeable && OPEN_WRITEABLE(req->flags);
+			}
 		}
 
 		if (h) {