From 89acedb9b8c8cf88f0a706184852adb7e8767b14 Mon Sep 17 00:00:00 2001
From: cinap_lenrek <cinap_lenrek@felloff.net>
Date: Mon, 26 May 2014 22:43:21 +0200
Subject: devproc: fix close and closefiles procctl

for the CMclose procctl, the fd number was not
bounds checked before indexing in the Fgrp.fd
array.

for the CMclosefiles, we looped fd from 0..maxfd-1,
but need to loop from 0..maxfd as maxfd is inclusive.
---
 sys/src/9/port/devproc.c | 39 +++++++++++++++++----------------------
 1 file changed, 17 insertions(+), 22 deletions(-)

diff --git a/sys/src/9/port/devproc.c b/sys/src/9/port/devproc.c
index 1258e46d8..db229802d 100644
--- a/sys/src/9/port/devproc.c
+++ b/sys/src/9/port/devproc.c
@@ -1270,39 +1270,34 @@ procstopwait(Proc *p, int ctl)
 		error(Eprocdied);
 }
 
-static void
-procctlcloseone(Proc *p, Fgrp *f, int fd)
-{
-	Chan *c;
-
-	c = f->fd[fd];
-	if(c == nil)
-		return;
-	f->fd[fd] = nil;
-	unlock(f);
-	qunlock(&p->debug);
-	cclose(c);
-	qlock(&p->debug);
-	lock(f);
-}
-
 void
 procctlclosefiles(Proc *p, int all, int fd)
 {
-	int i;
 	Fgrp *f;
+	Chan *c;
 
+	if(fd < 0)
+		error(Ebadfd);
 	f = p->fgrp;
 	if(f == nil)
 		error(Eprocdied);
 
 	lock(f);
 	f->ref++;
-	if(all)
-		for(i = 0; i < f->maxfd; i++)
-			procctlcloseone(p, f, i);
-	else
-		procctlcloseone(p, f, fd);
+	while(fd <= f->maxfd){
+		c = f->fd[fd];
+		if(c != nil){
+			f->fd[fd] = nil;
+			unlock(f);
+			qunlock(&p->debug);
+			cclose(c);
+			qlock(&p->debug);
+			lock(f);
+		}
+		if(!all)
+			break;
+		fd++;
+	}
 	unlock(f);
 	closefgrp(f);
 }
-- 
cgit v1.2.3


From 9ebbfae28b3be0ffcc2122024441cac2f0025c09 Mon Sep 17 00:00:00 2001
From: cinap_lenrek <cinap_lenrek@felloff.net>
Date: Mon, 26 May 2014 22:47:34 +0200
Subject: kernel: simplify fdclose()

---
 sys/src/9/port/sysfile.c | 18 +++++-------------
 1 file changed, 5 insertions(+), 13 deletions(-)

diff --git a/sys/src/9/port/sysfile.c b/sys/src/9/port/sysfile.c
index 9dfeb5371..a354d6e96 100644
--- a/sys/src/9/port/sysfile.c
+++ b/sys/src/9/port/sysfile.c
@@ -292,28 +292,20 @@ sysopen(va_list list)
 void
 fdclose(int fd, int flag)
 {
-	int i;
 	Chan *c;
 	Fgrp *f = up->fgrp;
 
 	lock(f);
 	c = f->fd[fd];
-	if(c == 0){
-		/* can happen for users with shared fd tables */
+	if(c == nil || (flag != 0 && (c->flag&flag) == 0)){
 		unlock(f);
 		return;
 	}
-	if(flag){
-		if(c==0 || !(c->flag&flag)){
-			unlock(f);
-			return;
-		}
+	f->fd[fd] = nil;
+	if(fd == f->maxfd){
+		while(fd > 0 && f->fd[fd] == nil)
+			f->maxfd = --fd;
 	}
-	f->fd[fd] = 0;
-	if(fd == f->maxfd)
-		for(i=fd; --i>=0 && f->fd[i]==0; )
-			f->maxfd = i;
-
 	unlock(f);
 	cclose(c);
 }
-- 
cgit v1.2.3