Module Name: src Committed By: bouyer Date: Mon Apr 21 10:15:38 UTC 2014
Modified Files: src/external/cddl/osnet/dist/uts/common/fs/zfs [netbsd-6-0]: zfs_vfsops.c src/sys/coda [netbsd-6-0]: coda_vfsops.c src/sys/fs/adosfs [netbsd-6-0]: advfsops.c src/sys/fs/cd9660 [netbsd-6-0]: cd9660_vfsops.c src/sys/fs/efs [netbsd-6-0]: efs_vfsops.c src/sys/fs/filecorefs [netbsd-6-0]: filecore_vfsops.c src/sys/fs/hfs [netbsd-6-0]: hfs_vfsops.c src/sys/fs/msdosfs [netbsd-6-0]: msdosfs_vfsops.c src/sys/fs/nilfs [netbsd-6-0]: nilfs_vfsops.c src/sys/fs/ntfs [netbsd-6-0]: ntfs_vfsops.c src/sys/fs/ptyfs [netbsd-6-0]: ptyfs_vfsops.c src/sys/fs/puffs [netbsd-6-0]: puffs_vfsops.c src/sys/fs/smbfs [netbsd-6-0]: smbfs_vfsops.c src/sys/fs/sysvbfs [netbsd-6-0]: sysvbfs_vfsops.c src/sys/fs/tmpfs [netbsd-6-0]: tmpfs_vfsops.c src/sys/fs/udf [netbsd-6-0]: udf_vfsops.c src/sys/fs/union [netbsd-6-0]: union_vfsops.c src/sys/fs/unionfs [netbsd-6-0]: unionfs_vfsops.c src/sys/fs/v7fs [netbsd-6-0]: v7fs_vfsops.c src/sys/kern [netbsd-6-0]: vfs_syscalls.c src/sys/miscfs/nullfs [netbsd-6-0]: null_vfsops.c src/sys/miscfs/overlay [netbsd-6-0]: overlay_vfsops.c src/sys/miscfs/procfs [netbsd-6-0]: procfs_vfsops.c src/sys/miscfs/umapfs [netbsd-6-0]: umap_vfsops.c src/sys/nfs [netbsd-6-0]: nfs_vfsops.c src/sys/ufs/chfs [netbsd-6-0]: chfs_vfsops.c src/sys/ufs/ext2fs [netbsd-6-0]: ext2fs_vfsops.c src/sys/ufs/ffs [netbsd-6-0]: ffs_vfsops.c src/sys/ufs/lfs [netbsd-6-0]: lfs_vfsops.c src/sys/ufs/mfs [netbsd-6-0]: mfs_vfsops.c Log Message: Pull up following revision(s) (requested by maxv in ticket #1050): sys/ufs/chfs/chfs_vfsops.c: revision 1.11 sys/fs/unionfs/unionfs_vfsops.c: revision 1.13 sys/fs/nilfs/nilfs_vfsops.c: revision 1.16 sys/ufs/mfs/mfs_vfsops.c: revision 1.107 sys/fs/sysvbfs/sysvbfs_vfsops.c: revision 1.43 sys/ufs/ffs/ffs_vfsops.c: revision 1.297 sys/kern/vfs_syscalls.c: revision 1.478 sys/kern/vfs_syscalls.c: revision 1.479 sys/fs/puffs/puffs_vfsops.c: revision 1.110 sys/fs/cd9660/cd9660_vfsops.c: revision 1.84 sys/nfs/nfs_vfsops.c: revision 1.227 sys/fs/v7fs/v7fs_vfsops.c: revision 1.10 sys/ufs/ext2fs/ext2fs_vfsops.c: revision 1.180 sys/miscfs/umapfs/umap_vfsops.c: revision 1.92 sys/fs/filecorefs/filecore_vfsops.c: revision 1.76 sys/miscfs/nullfs/null_vfsops.c: revision 1.88 sys/fs/ptyfs/ptyfs_vfsops.c: revision 1.50 sys/coda/coda_vfsops.c: revision 1.81 sys/ufs/lfs/lfs_vfsops.c: revision 1.321 sys/fs/tmpfs/tmpfs_vfsops.c: revision 1.59 sys/fs/hfs/hfs_vfsops.c: revision 1.31 sys/miscfs/overlay/overlay_vfsops.c: revision 1.61 sys/fs/union/union_vfsops.c: revision 1.72 sys/fs/ntfs/ntfs_vfsops.c: revision 1.94 sys/kern/vfs_syscalls.c: revision 1.480 sys/fs/efs/efs_vfsops.c: revision 1.25 sys/kern/vfs_syscalls.c: revision 1.482 sys/fs/msdosfs/msdosfs_vfsops.c: revision 1.107 external/cddl/osnet/dist/uts/common/fs/zfs/zfs_vfsops.c: revision 1.12 sys/miscfs/procfs/procfs_vfsops.c: revision 1.91 sys/fs/smbfs/smbfs_vfsops.c: revision 1.100 sys/fs/adosfs/advfsops.c: revision 1.70 sys/fs/udf/udf_vfsops.c: revision 1.67 Limit check for 'data_len'. Otherwise a (un)privileged user can easily panic the system by passing a huge size. ok christos@ An (un)privileged user can easily make the kernel dereference a NULL pointer. The kernel allows 'data' to be NULL; it's the fs's responsibility to ensure that it isn't NULL (if the fs actually needs data). ok christos@ Some fs's - like kernfs - set their vfs_min_mount_data to zero. Add a check to prevent an (un)privileged user from requesting a zero-sized allocation (and thus a panic). This thing is totally buggy: 'data_len' is modified by the fs, so calling kmem_free with it while its value has changed since the kmem_alloc is far from being a good idea. If the kernel figures out that something mismatches, it will panic (typically with kernfs). To generate a diff of this commit: cvs rdiff -u -r1.7 -r1.7.8.1 \ src/external/cddl/osnet/dist/uts/common/fs/zfs/zfs_vfsops.c cvs rdiff -u -r1.70 -r1.70.12.1 src/sys/coda/coda_vfsops.c cvs rdiff -u -r1.63 -r1.63.10.1 src/sys/fs/adosfs/advfsops.c cvs rdiff -u -r1.74 -r1.74.10.1 src/sys/fs/cd9660/cd9660_vfsops.c cvs rdiff -u -r1.22 -r1.22.12.1 src/sys/fs/efs/efs_vfsops.c cvs rdiff -u -r1.68 -r1.68.10.1 src/sys/fs/filecorefs/filecore_vfsops.c cvs rdiff -u -r1.27.8.1 -r1.27.8.1.4.1 src/sys/fs/hfs/hfs_vfsops.c cvs rdiff -u -r1.93.6.1 -r1.93.6.1.4.1 src/sys/fs/msdosfs/msdosfs_vfsops.c cvs rdiff -u -r1.8 -r1.8.10.1 src/sys/fs/nilfs/nilfs_vfsops.c cvs rdiff -u -r1.87 -r1.87.12.1 src/sys/fs/ntfs/ntfs_vfsops.c cvs rdiff -u -r1.42.18.1 -r1.42.18.1.2.1 src/sys/fs/ptyfs/ptyfs_vfsops.c cvs rdiff -u -r1.100.8.2 -r1.100.8.2.4.1 src/sys/fs/puffs/puffs_vfsops.c cvs rdiff -u -r1.95 -r1.95.14.1 src/sys/fs/smbfs/smbfs_vfsops.c cvs rdiff -u -r1.38.6.1 -r1.38.6.1.4.1 src/sys/fs/sysvbfs/sysvbfs_vfsops.c cvs rdiff -u -r1.52 -r1.52.14.1 src/sys/fs/tmpfs/tmpfs_vfsops.c cvs rdiff -u -r1.62 -r1.62.10.1 src/sys/fs/udf/udf_vfsops.c cvs rdiff -u -r1.67 -r1.67.6.1 src/sys/fs/union/union_vfsops.c cvs rdiff -u -r1.9 -r1.9.16.1 src/sys/fs/unionfs/unionfs_vfsops.c cvs rdiff -u -r1.5.6.1 -r1.5.6.1.4.1 src/sys/fs/v7fs/v7fs_vfsops.c cvs rdiff -u -r1.449.2.2 -r1.449.2.2.4.1 src/sys/kern/vfs_syscalls.c cvs rdiff -u -r1.83 -r1.83.18.1 src/sys/miscfs/nullfs/null_vfsops.c cvs rdiff -u -r1.56 -r1.56.18.1 src/sys/miscfs/overlay/overlay_vfsops.c cvs rdiff -u -r1.86 -r1.86.12.1 src/sys/miscfs/procfs/procfs_vfsops.c cvs rdiff -u -r1.86 -r1.86.18.1 src/sys/miscfs/umapfs/umap_vfsops.c cvs rdiff -u -r1.220 -r1.220.14.1 src/sys/nfs/nfs_vfsops.c cvs rdiff -u -r1.2 -r1.2.8.1 src/sys/ufs/chfs/chfs_vfsops.c cvs rdiff -u -r1.162 -r1.162.10.1 src/sys/ufs/ext2fs/ext2fs_vfsops.c cvs rdiff -u -r1.275.2.2 -r1.275.2.2.2.1 src/sys/ufs/ffs/ffs_vfsops.c cvs rdiff -u -r1.293.2.1 -r1.293.2.1.4.1 src/sys/ufs/lfs/lfs_vfsops.c cvs rdiff -u -r1.103 -r1.103.14.1 src/sys/ufs/mfs/mfs_vfsops.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
Modified files: Index: src/external/cddl/osnet/dist/uts/common/fs/zfs/zfs_vfsops.c diff -u src/external/cddl/osnet/dist/uts/common/fs/zfs/zfs_vfsops.c:1.7 src/external/cddl/osnet/dist/uts/common/fs/zfs/zfs_vfsops.c:1.7.8.1 --- src/external/cddl/osnet/dist/uts/common/fs/zfs/zfs_vfsops.c:1.7 Sun Nov 20 02:54:25 2011 +++ src/external/cddl/osnet/dist/uts/common/fs/zfs/zfs_vfsops.c Mon Apr 21 10:15:37 2014 @@ -1624,6 +1624,9 @@ zfs_mount(vfs_t *vfsp, const char *path, if (mvp->v_type != VDIR) return (ENOTDIR); + if (uap == NULL) + return (EINVAL); + mutex_enter(mvp->v_interlock); if ((uap->flags & MS_REMOUNT) == 0 && (uap->flags & MS_OVERLAY) == 0 && Index: src/sys/coda/coda_vfsops.c diff -u src/sys/coda/coda_vfsops.c:1.70 src/sys/coda/coda_vfsops.c:1.70.12.1 --- src/sys/coda/coda_vfsops.c:1.70 Tue Sep 27 00:54:47 2011 +++ src/sys/coda/coda_vfsops.c Mon Apr 21 10:15:37 2014 @@ -1,4 +1,4 @@ -/* $NetBSD: coda_vfsops.c,v 1.70 2011/09/27 00:54:47 christos Exp $ */ +/* $NetBSD: coda_vfsops.c,v 1.70.12.1 2014/04/21 10:15:37 bouyer Exp $ */ /* * @@ -45,7 +45,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: coda_vfsops.c,v 1.70 2011/09/27 00:54:47 christos Exp $"); +__KERNEL_RCSID(0, "$NetBSD: coda_vfsops.c,v 1.70.12.1 2014/04/21 10:15:37 bouyer Exp $"); #ifndef _KERNEL_OPT #define NVCODA 4 @@ -185,6 +185,8 @@ coda_mount(struct mount *vfsp, /* Alloca CodaFid ctlfid = CTL_FID; int error; + if (data == NULL) + return EINVAL; if (vfsp->mnt_flag & MNT_GETARGS) return EINVAL; ENTRY; Index: src/sys/fs/adosfs/advfsops.c diff -u src/sys/fs/adosfs/advfsops.c:1.63 src/sys/fs/adosfs/advfsops.c:1.63.10.1 --- src/sys/fs/adosfs/advfsops.c:1.63 Mon Nov 14 18:35:12 2011 +++ src/sys/fs/adosfs/advfsops.c Mon Apr 21 10:15:38 2014 @@ -1,4 +1,4 @@ -/* $NetBSD: advfsops.c,v 1.63 2011/11/14 18:35:12 hannken Exp $ */ +/* $NetBSD: advfsops.c,v 1.63.10.1 2014/04/21 10:15:38 bouyer Exp $ */ /* * Copyright (c) 1994 Christian E. Hopps @@ -32,7 +32,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: advfsops.c,v 1.63 2011/11/14 18:35:12 hannken Exp $"); +__KERNEL_RCSID(0, "$NetBSD: advfsops.c,v 1.63.10.1 2014/04/21 10:15:38 bouyer Exp $"); #if defined(_KERNEL_OPT) #include "opt_compat_netbsd.h" @@ -91,6 +91,8 @@ adosfs_mount(struct mount *mp, const cha int error; mode_t accessmode; + if (args == NULL) + return EINVAL; if (*data_len < sizeof *args) return EINVAL; Index: src/sys/fs/cd9660/cd9660_vfsops.c diff -u src/sys/fs/cd9660/cd9660_vfsops.c:1.74 src/sys/fs/cd9660/cd9660_vfsops.c:1.74.10.1 --- src/sys/fs/cd9660/cd9660_vfsops.c:1.74 Mon Nov 14 18:35:12 2011 +++ src/sys/fs/cd9660/cd9660_vfsops.c Mon Apr 21 10:15:36 2014 @@ -1,4 +1,4 @@ -/* $NetBSD: cd9660_vfsops.c,v 1.74 2011/11/14 18:35:12 hannken Exp $ */ +/* $NetBSD: cd9660_vfsops.c,v 1.74.10.1 2014/04/21 10:15:36 bouyer Exp $ */ /*- * Copyright (c) 1994 @@ -37,7 +37,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: cd9660_vfsops.c,v 1.74 2011/11/14 18:35:12 hannken Exp $"); +__KERNEL_RCSID(0, "$NetBSD: cd9660_vfsops.c,v 1.74.10.1 2014/04/21 10:15:36 bouyer Exp $"); #if defined(_KERNEL_OPT) #include "opt_compat_netbsd.h" @@ -224,6 +224,8 @@ cd9660_mount(struct mount *mp, const cha int error; struct iso_mnt *imp = VFSTOISOFS(mp); + if (args == NULL) + return EINVAL; if (*data_len < sizeof *args) return EINVAL; Index: src/sys/fs/efs/efs_vfsops.c diff -u src/sys/fs/efs/efs_vfsops.c:1.22 src/sys/fs/efs/efs_vfsops.c:1.22.12.1 --- src/sys/fs/efs/efs_vfsops.c:1.22 Sun Jun 12 03:35:52 2011 +++ src/sys/fs/efs/efs_vfsops.c Mon Apr 21 10:15:37 2014 @@ -1,4 +1,4 @@ -/* $NetBSD: efs_vfsops.c,v 1.22 2011/06/12 03:35:52 rmind Exp $ */ +/* $NetBSD: efs_vfsops.c,v 1.22.12.1 2014/04/21 10:15:37 bouyer Exp $ */ /* * Copyright (c) 2006 Stephen M. Rumble <rum...@ephemeral.org> @@ -17,7 +17,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: efs_vfsops.c,v 1.22 2011/06/12 03:35:52 rmind Exp $"); +__KERNEL_RCSID(0, "$NetBSD: efs_vfsops.c,v 1.22.12.1 2014/04/21 10:15:37 bouyer Exp $"); #include <sys/param.h> #include <sys/systm.h> @@ -182,6 +182,8 @@ efs_mount(struct mount *mp, const char * struct vnode *devvp; int err, mode; + if (args == NULL) + return EINVAL; if (*data_len < sizeof *args) return EINVAL; Index: src/sys/fs/filecorefs/filecore_vfsops.c diff -u src/sys/fs/filecorefs/filecore_vfsops.c:1.68 src/sys/fs/filecorefs/filecore_vfsops.c:1.68.10.1 --- src/sys/fs/filecorefs/filecore_vfsops.c:1.68 Mon Nov 14 18:35:13 2011 +++ src/sys/fs/filecorefs/filecore_vfsops.c Mon Apr 21 10:15:37 2014 @@ -1,4 +1,4 @@ -/* $NetBSD: filecore_vfsops.c,v 1.68 2011/11/14 18:35:13 hannken Exp $ */ +/* $NetBSD: filecore_vfsops.c,v 1.68.10.1 2014/04/21 10:15:37 bouyer Exp $ */ /*- * Copyright (c) 1994 The Regents of the University of California. @@ -66,7 +66,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: filecore_vfsops.c,v 1.68 2011/11/14 18:35:13 hannken Exp $"); +__KERNEL_RCSID(0, "$NetBSD: filecore_vfsops.c,v 1.68.10.1 2014/04/21 10:15:37 bouyer Exp $"); #if defined(_KERNEL_OPT) #include "opt_compat_netbsd.h" @@ -239,6 +239,8 @@ filecore_mount(struct mount *mp, const c int error; struct filecore_mnt *fcmp = NULL; + if (args == NULL) + return EINVAL; if (*data_len < sizeof *args) return EINVAL; Index: src/sys/fs/hfs/hfs_vfsops.c diff -u src/sys/fs/hfs/hfs_vfsops.c:1.27.8.1 src/sys/fs/hfs/hfs_vfsops.c:1.27.8.1.4.1 --- src/sys/fs/hfs/hfs_vfsops.c:1.27.8.1 Sun Jun 24 16:03:39 2012 +++ src/sys/fs/hfs/hfs_vfsops.c Mon Apr 21 10:15:37 2014 @@ -1,4 +1,4 @@ -/* $NetBSD: hfs_vfsops.c,v 1.27.8.1 2012/06/24 16:03:39 jdc Exp $ */ +/* $NetBSD: hfs_vfsops.c,v 1.27.8.1.4.1 2014/04/21 10:15:37 bouyer Exp $ */ /*- * Copyright (c) 2005, 2007 The NetBSD Foundation, Inc. @@ -99,7 +99,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: hfs_vfsops.c,v 1.27.8.1 2012/06/24 16:03:39 jdc Exp $"); +__KERNEL_RCSID(0, "$NetBSD: hfs_vfsops.c,v 1.27.8.1.4.1 2014/04/21 10:15:37 bouyer Exp $"); #ifdef _KERNEL_OPT #include "opt_compat_netbsd.h" @@ -205,6 +205,8 @@ hfs_mount(struct mount *mp, const char * int update; mode_t accessmode; + if (args == NULL) + return EINVAL; if (*data_len < sizeof *args) return EINVAL; Index: src/sys/fs/msdosfs/msdosfs_vfsops.c diff -u src/sys/fs/msdosfs/msdosfs_vfsops.c:1.93.6.1 src/sys/fs/msdosfs/msdosfs_vfsops.c:1.93.6.1.4.1 --- src/sys/fs/msdosfs/msdosfs_vfsops.c:1.93.6.1 Thu Jul 5 17:36:31 2012 +++ src/sys/fs/msdosfs/msdosfs_vfsops.c Mon Apr 21 10:15:37 2014 @@ -1,4 +1,4 @@ -/* $NetBSD: msdosfs_vfsops.c,v 1.93.6.1 2012/07/05 17:36:31 riz Exp $ */ +/* $NetBSD: msdosfs_vfsops.c,v 1.93.6.1.4.1 2014/04/21 10:15:37 bouyer Exp $ */ /*- * Copyright (C) 1994, 1995, 1997 Wolfgang Solfrank. @@ -48,7 +48,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: msdosfs_vfsops.c,v 1.93.6.1 2012/07/05 17:36:31 riz Exp $"); +__KERNEL_RCSID(0, "$NetBSD: msdosfs_vfsops.c,v 1.93.6.1.4.1 2014/04/21 10:15:37 bouyer Exp $"); #if defined(_KERNEL_OPT) #include "opt_compat_netbsd.h" @@ -293,6 +293,8 @@ msdosfs_mount(struct mount *mp, const ch int error, flags; mode_t accessmode; + if (args == NULL) + return EINVAL; if (*data_len < sizeof *args) return EINVAL; Index: src/sys/fs/nilfs/nilfs_vfsops.c diff -u src/sys/fs/nilfs/nilfs_vfsops.c:1.8 src/sys/fs/nilfs/nilfs_vfsops.c:1.8.10.1 --- src/sys/fs/nilfs/nilfs_vfsops.c:1.8 Mon Nov 14 18:35:13 2011 +++ src/sys/fs/nilfs/nilfs_vfsops.c Mon Apr 21 10:15:36 2014 @@ -1,4 +1,4 @@ -/* $NetBSD: nilfs_vfsops.c,v 1.8 2011/11/14 18:35:13 hannken Exp $ */ +/* $NetBSD: nilfs_vfsops.c,v 1.8.10.1 2014/04/21 10:15:36 bouyer Exp $ */ /* * Copyright (c) 2008, 2009 Reinoud Zandijk @@ -28,7 +28,7 @@ #include <sys/cdefs.h> #ifndef lint -__KERNEL_RCSID(0, "$NetBSD: nilfs_vfsops.c,v 1.8 2011/11/14 18:35:13 hannken Exp $"); +__KERNEL_RCSID(0, "$NetBSD: nilfs_vfsops.c,v 1.8.10.1 2014/04/21 10:15:36 bouyer Exp $"); #endif /* not lint */ @@ -804,6 +804,8 @@ nilfs_mount(struct mount *mp, const char DPRINTF(VFSCALL, ("nilfs_mount called\n")); + if (args == NULL) + return EINVAL; if (*data_len < sizeof *args) return EINVAL; Index: src/sys/fs/ntfs/ntfs_vfsops.c diff -u src/sys/fs/ntfs/ntfs_vfsops.c:1.87 src/sys/fs/ntfs/ntfs_vfsops.c:1.87.12.1 --- src/sys/fs/ntfs/ntfs_vfsops.c:1.87 Mon Nov 14 18:35:13 2011 +++ src/sys/fs/ntfs/ntfs_vfsops.c Mon Apr 21 10:15:37 2014 @@ -1,4 +1,4 @@ -/* $NetBSD: ntfs_vfsops.c,v 1.87 2011/11/14 18:35:13 hannken Exp $ */ +/* $NetBSD: ntfs_vfsops.c,v 1.87.12.1 2014/04/21 10:15:37 bouyer Exp $ */ /*- * Copyright (c) 1998, 1999 Semen Ustimenko @@ -29,7 +29,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: ntfs_vfsops.c,v 1.87 2011/11/14 18:35:13 hannken Exp $"); +__KERNEL_RCSID(0, "$NetBSD: ntfs_vfsops.c,v 1.87.12.1 2014/04/21 10:15:37 bouyer Exp $"); #include <sys/param.h> #include <sys/systm.h> @@ -174,6 +174,8 @@ ntfs_mount ( struct vnode *devvp; struct ntfs_args *args = data; + if (args == NULL) + return EINVAL; if (*data_len < sizeof *args) return EINVAL; Index: src/sys/fs/ptyfs/ptyfs_vfsops.c diff -u src/sys/fs/ptyfs/ptyfs_vfsops.c:1.42.18.1 src/sys/fs/ptyfs/ptyfs_vfsops.c:1.42.18.1.2.1 --- src/sys/fs/ptyfs/ptyfs_vfsops.c:1.42.18.1 Mon Oct 1 17:35:05 2012 +++ src/sys/fs/ptyfs/ptyfs_vfsops.c Mon Apr 21 10:15:37 2014 @@ -1,4 +1,4 @@ -/* $NetBSD: ptyfs_vfsops.c,v 1.42.18.1 2012/10/01 17:35:05 riz Exp $ */ +/* $NetBSD: ptyfs_vfsops.c,v 1.42.18.1.2.1 2014/04/21 10:15:37 bouyer Exp $ */ /* * Copyright (c) 1992, 1993, 1995 @@ -38,7 +38,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: ptyfs_vfsops.c,v 1.42.18.1 2012/10/01 17:35:05 riz Exp $"); +__KERNEL_RCSID(0, "$NetBSD: ptyfs_vfsops.c,v 1.42.18.1.2.1 2014/04/21 10:15:37 bouyer Exp $"); #include <sys/param.h> #include <sys/systm.h> @@ -218,6 +218,8 @@ ptyfs_mount(struct mount *mp, const char struct ptyfsmount *pmnt; struct ptyfs_args *args = data; + if (args == NULL) + return EINVAL; if (*data_len != sizeof *args && *data_len != OSIZE) return EINVAL; Index: src/sys/fs/puffs/puffs_vfsops.c diff -u src/sys/fs/puffs/puffs_vfsops.c:1.100.8.2 src/sys/fs/puffs/puffs_vfsops.c:1.100.8.2.4.1 --- src/sys/fs/puffs/puffs_vfsops.c:1.100.8.2 Sun Aug 12 13:13:21 2012 +++ src/sys/fs/puffs/puffs_vfsops.c Mon Apr 21 10:15:36 2014 @@ -1,4 +1,4 @@ -/* $NetBSD: puffs_vfsops.c,v 1.100.8.2 2012/08/12 13:13:21 martin Exp $ */ +/* $NetBSD: puffs_vfsops.c,v 1.100.8.2.4.1 2014/04/21 10:15:36 bouyer Exp $ */ /* * Copyright (c) 2005, 2006 Antti Kantee. All Rights Reserved. @@ -30,7 +30,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: puffs_vfsops.c,v 1.100.8.2 2012/08/12 13:13:21 martin Exp $"); +__KERNEL_RCSID(0, "$NetBSD: puffs_vfsops.c,v 1.100.8.2.4.1 2014/04/21 10:15:36 bouyer Exp $"); #include <sys/param.h> #include <sys/kernel.h> @@ -102,6 +102,8 @@ puffs_vfsop_mount(struct mount *mp, cons int error = 0, i; pid_t mntpid = curlwp->l_proc->p_pid; + if (data == NULL) + return EINVAL; if (*data_len < sizeof *args) return EINVAL; @@ -116,12 +118,6 @@ puffs_vfsop_mount(struct mount *mp, cons if (mp->mnt_flag & MNT_UPDATE) return EOPNOTSUPP; - /* - * We need the file system name - */ - if (!data) - return EINVAL; - args = (struct puffs_kargs *)data; if (args->pa_vers != PUFFSVERSION) { Index: src/sys/fs/smbfs/smbfs_vfsops.c diff -u src/sys/fs/smbfs/smbfs_vfsops.c:1.95 src/sys/fs/smbfs/smbfs_vfsops.c:1.95.14.1 --- src/sys/fs/smbfs/smbfs_vfsops.c:1.95 Fri Oct 7 09:35:05 2011 +++ src/sys/fs/smbfs/smbfs_vfsops.c Mon Apr 21 10:15:38 2014 @@ -1,4 +1,4 @@ -/* $NetBSD: smbfs_vfsops.c,v 1.95 2011/10/07 09:35:05 hannken Exp $ */ +/* $NetBSD: smbfs_vfsops.c,v 1.95.14.1 2014/04/21 10:15:38 bouyer Exp $ */ /* * Copyright (c) 2000-2001, Boris Popov @@ -35,7 +35,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: smbfs_vfsops.c,v 1.95 2011/10/07 09:35:05 hannken Exp $"); +__KERNEL_RCSID(0, "$NetBSD: smbfs_vfsops.c,v 1.95.14.1 2014/04/21 10:15:38 bouyer Exp $"); #include <sys/param.h> #include <sys/systm.h> @@ -164,6 +164,8 @@ smbfs_mount(struct mount *mp, const char char *fromname; int error; + if (args == NULL) + return EINVAL; if (*data_len < sizeof *args) return EINVAL; Index: src/sys/fs/sysvbfs/sysvbfs_vfsops.c diff -u src/sys/fs/sysvbfs/sysvbfs_vfsops.c:1.38.6.1 src/sys/fs/sysvbfs/sysvbfs_vfsops.c:1.38.6.1.4.1 --- src/sys/fs/sysvbfs/sysvbfs_vfsops.c:1.38.6.1 Sun Jun 24 16:03:39 2012 +++ src/sys/fs/sysvbfs/sysvbfs_vfsops.c Mon Apr 21 10:15:36 2014 @@ -1,4 +1,4 @@ -/* $NetBSD: sysvbfs_vfsops.c,v 1.38.6.1 2012/06/24 16:03:39 jdc Exp $ */ +/* $NetBSD: sysvbfs_vfsops.c,v 1.38.6.1.4.1 2014/04/21 10:15:36 bouyer Exp $ */ /*- * Copyright (c) 2004 The NetBSD Foundation, Inc. @@ -30,7 +30,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: sysvbfs_vfsops.c,v 1.38.6.1 2012/06/24 16:03:39 jdc Exp $"); +__KERNEL_RCSID(0, "$NetBSD: sysvbfs_vfsops.c,v 1.38.6.1.4.1 2014/04/21 10:15:36 bouyer Exp $"); #include <sys/types.h> #include <sys/param.h> @@ -77,6 +77,8 @@ sysvbfs_mount(struct mount *mp, const ch DPRINTF("%s: mnt_flag=%x\n", __func__, mp->mnt_flag); + if (args == NULL) + return EINVAL; if (*data_len < sizeof *args) return EINVAL; Index: src/sys/fs/tmpfs/tmpfs_vfsops.c diff -u src/sys/fs/tmpfs/tmpfs_vfsops.c:1.52 src/sys/fs/tmpfs/tmpfs_vfsops.c:1.52.14.1 --- src/sys/fs/tmpfs/tmpfs_vfsops.c:1.52 Tue Sep 27 01:10:43 2011 +++ src/sys/fs/tmpfs/tmpfs_vfsops.c Mon Apr 21 10:15:37 2014 @@ -1,4 +1,4 @@ -/* $NetBSD: tmpfs_vfsops.c,v 1.52 2011/09/27 01:10:43 christos Exp $ */ +/* $NetBSD: tmpfs_vfsops.c,v 1.52.14.1 2014/04/21 10:15:37 bouyer Exp $ */ /* * Copyright (c) 2005, 2006, 2007 The NetBSD Foundation, Inc. @@ -42,7 +42,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: tmpfs_vfsops.c,v 1.52 2011/09/27 01:10:43 christos Exp $"); +__KERNEL_RCSID(0, "$NetBSD: tmpfs_vfsops.c,v 1.52.14.1 2014/04/21 10:15:37 bouyer Exp $"); #include <sys/param.h> #include <sys/types.h> @@ -103,6 +103,9 @@ tmpfs_mount(struct mount *mp, const char ino_t nodes; int error; + if (args == NULL) + return EINVAL; + /* Validate the version. */ if (*data_len < sizeof(*args) || args->ta_version != TMPFS_ARGS_VERSION) Index: src/sys/fs/udf/udf_vfsops.c diff -u src/sys/fs/udf/udf_vfsops.c:1.62 src/sys/fs/udf/udf_vfsops.c:1.62.10.1 --- src/sys/fs/udf/udf_vfsops.c:1.62 Mon Nov 14 18:35:14 2011 +++ src/sys/fs/udf/udf_vfsops.c Mon Apr 21 10:15:38 2014 @@ -1,4 +1,4 @@ -/* $NetBSD: udf_vfsops.c,v 1.62 2011/11/14 18:35:14 hannken Exp $ */ +/* $NetBSD: udf_vfsops.c,v 1.62.10.1 2014/04/21 10:15:38 bouyer Exp $ */ /* * Copyright (c) 2006, 2008 Reinoud Zandijk @@ -28,7 +28,7 @@ #include <sys/cdefs.h> #ifndef lint -__KERNEL_RCSID(0, "$NetBSD: udf_vfsops.c,v 1.62 2011/11/14 18:35:14 hannken Exp $"); +__KERNEL_RCSID(0, "$NetBSD: udf_vfsops.c,v 1.62.10.1 2014/04/21 10:15:38 bouyer Exp $"); #endif /* not lint */ @@ -323,6 +323,8 @@ udf_mount(struct mount *mp, const char * DPRINTF(CALL, ("udf_mount called\n")); + if (args == NULL) + return EINVAL; if (*data_len < sizeof *args) return EINVAL; Index: src/sys/fs/union/union_vfsops.c diff -u src/sys/fs/union/union_vfsops.c:1.67 src/sys/fs/union/union_vfsops.c:1.67.6.1 --- src/sys/fs/union/union_vfsops.c:1.67 Mon Dec 5 11:12:10 2011 +++ src/sys/fs/union/union_vfsops.c Mon Apr 21 10:15:37 2014 @@ -1,4 +1,4 @@ -/* $NetBSD: union_vfsops.c,v 1.67 2011/12/05 11:12:10 hannken Exp $ */ +/* $NetBSD: union_vfsops.c,v 1.67.6.1 2014/04/21 10:15:37 bouyer Exp $ */ /* * Copyright (c) 1994 The Regents of the University of California. @@ -77,7 +77,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: union_vfsops.c,v 1.67 2011/12/05 11:12:10 hannken Exp $"); +__KERNEL_RCSID(0, "$NetBSD: union_vfsops.c,v 1.67.6.1 2014/04/21 10:15:37 bouyer Exp $"); #include <sys/param.h> #include <sys/systm.h> @@ -119,6 +119,8 @@ union_mount(struct mount *mp, const char int len; size_t size; + if (args == NULL) + return EINVAL; if (*data_len < sizeof *args) return EINVAL; Index: src/sys/fs/unionfs/unionfs_vfsops.c diff -u src/sys/fs/unionfs/unionfs_vfsops.c:1.9 src/sys/fs/unionfs/unionfs_vfsops.c:1.9.16.1 --- src/sys/fs/unionfs/unionfs_vfsops.c:1.9 Sun Mar 6 17:08:35 2011 +++ src/sys/fs/unionfs/unionfs_vfsops.c Mon Apr 21 10:15:36 2014 @@ -89,6 +89,8 @@ unionfs_mount(struct mount *mp, const ch const char *cp; char *xp; + if (args == NULL) + return EINVAL; if (*data_len < sizeof *args) return EINVAL; Index: src/sys/fs/v7fs/v7fs_vfsops.c diff -u src/sys/fs/v7fs/v7fs_vfsops.c:1.5.6.1 src/sys/fs/v7fs/v7fs_vfsops.c:1.5.6.1.4.1 --- src/sys/fs/v7fs/v7fs_vfsops.c:1.5.6.1 Sun Jun 24 16:03:40 2012 +++ src/sys/fs/v7fs/v7fs_vfsops.c Mon Apr 21 10:15:36 2014 @@ -1,4 +1,4 @@ -/* $NetBSD: v7fs_vfsops.c,v 1.5.6.1 2012/06/24 16:03:40 jdc Exp $ */ +/* $NetBSD: v7fs_vfsops.c,v 1.5.6.1.4.1 2014/04/21 10:15:36 bouyer Exp $ */ /*- * Copyright (c) 2004, 2011 The NetBSD Foundation, Inc. @@ -30,7 +30,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: v7fs_vfsops.c,v 1.5.6.1 2012/06/24 16:03:40 jdc Exp $"); +__KERNEL_RCSID(0, "$NetBSD: v7fs_vfsops.c,v 1.5.6.1.4.1 2014/04/21 10:15:36 bouyer Exp $"); #if defined _KERNEL_OPT #include "opt_v7fs.h" #endif @@ -90,6 +90,8 @@ v7fs_mount(struct mount *mp, const char DPRINTF("mnt_flag=%x %s\n", mp->mnt_flag, update ? "update" : ""); + if (args == NULL) + return EINVAL; if (*data_len < sizeof(*args)) return EINVAL; Index: src/sys/kern/vfs_syscalls.c diff -u src/sys/kern/vfs_syscalls.c:1.449.2.2 src/sys/kern/vfs_syscalls.c:1.449.2.2.4.1 --- src/sys/kern/vfs_syscalls.c:1.449.2.2 Sat May 19 15:01:35 2012 +++ src/sys/kern/vfs_syscalls.c Mon Apr 21 10:15:36 2014 @@ -1,4 +1,4 @@ -/* $NetBSD: vfs_syscalls.c,v 1.449.2.2 2012/05/19 15:01:35 riz Exp $ */ +/* $NetBSD: vfs_syscalls.c,v 1.449.2.2.4.1 2014/04/21 10:15:36 bouyer Exp $ */ /*- * Copyright (c) 2008, 2009 The NetBSD Foundation, Inc. @@ -70,7 +70,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: vfs_syscalls.c,v 1.449.2.2 2012/05/19 15:01:35 riz Exp $"); +__KERNEL_RCSID(0, "$NetBSD: vfs_syscalls.c,v 1.449.2.2.4.1 2014/04/21 10:15:36 bouyer Exp $"); #ifdef _KERNEL_OPT #include "opt_fileassoc.h" @@ -393,6 +393,7 @@ do_sys_mount(struct lwp *l, struct vfsop struct vnode *vp; void *data_buf = data; bool vfsopsrele = false; + size_t alloc_sz = 0; int error; /* XXX: The calling convention of this routine is totally bizarre */ @@ -420,14 +421,15 @@ do_sys_mount(struct lwp *l, struct vfsop } } + /* + * We allow data to be NULL, even for userspace. Some fs's don't need + * it. The others will handle NULL. + */ if (data != NULL && data_seg == UIO_USERSPACE) { if (data_len == 0) { /* No length supplied, use default for filesystem */ data_len = vfsops->vfs_min_mount_data; - if (data_len > VFS_MAX_MOUNT_DATA) { - error = EINVAL; - goto done; - } + /* * Hopefully a longer buffer won't make copyin() fail. * For compatibility with 3.0 and earlier. @@ -436,7 +438,12 @@ do_sys_mount(struct lwp *l, struct vfsop && data_len < sizeof (struct mnt_export_args30)) data_len = sizeof (struct mnt_export_args30); } - data_buf = kmem_alloc(data_len, KM_SLEEP); + if ((data_len == 0) || (data_len > VFS_MAX_MOUNT_DATA)) { + error = EINVAL; + goto done; + } + alloc_sz = data_len; + data_buf = kmem_alloc(alloc_sz, KM_SLEEP); /* NFS needs the buffer even for mnt_getargs .... */ error = copyin(data, data_buf, data_len); @@ -472,7 +479,7 @@ do_sys_mount(struct lwp *l, struct vfsop vrele(vp); } if (data_buf != data) - kmem_free(data_buf, data_len); + kmem_free(data_buf, alloc_sz); return (error); } Index: src/sys/miscfs/nullfs/null_vfsops.c diff -u src/sys/miscfs/nullfs/null_vfsops.c:1.83 src/sys/miscfs/nullfs/null_vfsops.c:1.83.18.1 --- src/sys/miscfs/nullfs/null_vfsops.c:1.83 Fri Nov 19 06:44:46 2010 +++ src/sys/miscfs/nullfs/null_vfsops.c Mon Apr 21 10:15:37 2014 @@ -1,4 +1,4 @@ -/* $NetBSD: null_vfsops.c,v 1.83 2010/11/19 06:44:46 dholland Exp $ */ +/* $NetBSD: null_vfsops.c,v 1.83.18.1 2014/04/21 10:15:37 bouyer Exp $ */ /* * Copyright (c) 1999 National Aeronautics & Space Administration @@ -76,7 +76,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: null_vfsops.c,v 1.83 2010/11/19 06:44:46 dholland Exp $"); +__KERNEL_RCSID(0, "$NetBSD: null_vfsops.c,v 1.83.18.1 2014/04/21 10:15:37 bouyer Exp $"); #include <sys/param.h> #include <sys/systm.h> @@ -107,6 +107,8 @@ nullfs_mount(struct mount *mp, const cha struct nameidata nd; int error; + if (args == NULL) + return EINVAL; if (*data_len < sizeof(*args)) return EINVAL; Index: src/sys/miscfs/overlay/overlay_vfsops.c diff -u src/sys/miscfs/overlay/overlay_vfsops.c:1.56 src/sys/miscfs/overlay/overlay_vfsops.c:1.56.18.1 --- src/sys/miscfs/overlay/overlay_vfsops.c:1.56 Fri Jul 9 08:14:26 2010 +++ src/sys/miscfs/overlay/overlay_vfsops.c Mon Apr 21 10:15:37 2014 @@ -1,4 +1,4 @@ -/* $NetBSD: overlay_vfsops.c,v 1.56 2010/07/09 08:14:26 hannken Exp $ */ +/* $NetBSD: overlay_vfsops.c,v 1.56.18.1 2014/04/21 10:15:37 bouyer Exp $ */ /* * Copyright (c) 1999, 2000 National Aeronautics & Space Administration @@ -74,7 +74,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: overlay_vfsops.c,v 1.56 2010/07/09 08:14:26 hannken Exp $"); +__KERNEL_RCSID(0, "$NetBSD: overlay_vfsops.c,v 1.56.18.1 2014/04/21 10:15:37 bouyer Exp $"); #include <sys/param.h> #include <sys/systm.h> @@ -114,6 +114,8 @@ ov_mount(struct mount *mp, const char *p printf("ov_mount(mp = %p)\n", mp); #endif + if (args == NULL) + return EINVAL; if (*data_len < sizeof *args) return EINVAL; Index: src/sys/miscfs/procfs/procfs_vfsops.c diff -u src/sys/miscfs/procfs/procfs_vfsops.c:1.86 src/sys/miscfs/procfs/procfs_vfsops.c:1.86.12.1 --- src/sys/miscfs/procfs/procfs_vfsops.c:1.86 Tue Sep 27 01:23:59 2011 +++ src/sys/miscfs/procfs/procfs_vfsops.c Mon Apr 21 10:15:38 2014 @@ -1,4 +1,4 @@ -/* $NetBSD: procfs_vfsops.c,v 1.86 2011/09/27 01:23:59 christos Exp $ */ +/* $NetBSD: procfs_vfsops.c,v 1.86.12.1 2014/04/21 10:15:38 bouyer Exp $ */ /* * Copyright (c) 1993 @@ -76,7 +76,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: procfs_vfsops.c,v 1.86 2011/09/27 01:23:59 christos Exp $"); +__KERNEL_RCSID(0, "$NetBSD: procfs_vfsops.c,v 1.86.12.1 2014/04/21 10:15:38 bouyer Exp $"); #if defined(_KERNEL_OPT) #include "opt_compat_netbsd.h" @@ -130,6 +130,9 @@ procfs_mount( struct procfs_args *args = data; int error; + if (args == NULL) + return EINVAL; + if (UIO_MX & (UIO_MX-1)) { log(LOG_ERR, "procfs: invalid directory entry size"); return (EINVAL); Index: src/sys/miscfs/umapfs/umap_vfsops.c diff -u src/sys/miscfs/umapfs/umap_vfsops.c:1.86 src/sys/miscfs/umapfs/umap_vfsops.c:1.86.18.1 --- src/sys/miscfs/umapfs/umap_vfsops.c:1.86 Fri Nov 19 06:44:46 2010 +++ src/sys/miscfs/umapfs/umap_vfsops.c Mon Apr 21 10:15:37 2014 @@ -1,4 +1,4 @@ -/* $NetBSD: umap_vfsops.c,v 1.86 2010/11/19 06:44:46 dholland Exp $ */ +/* $NetBSD: umap_vfsops.c,v 1.86.18.1 2014/04/21 10:15:37 bouyer Exp $ */ /* * Copyright (c) 1992, 1993 @@ -41,7 +41,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: umap_vfsops.c,v 1.86 2010/11/19 06:44:46 dholland Exp $"); +__KERNEL_RCSID(0, "$NetBSD: umap_vfsops.c,v 1.86.18.1 2014/04/21 10:15:37 bouyer Exp $"); #include <sys/param.h> #include <sys/systm.h> @@ -81,6 +81,8 @@ umapfs_mount(struct mount *mp, const cha int i; #endif + if (args == NULL) + return EINVAL; if (*data_len < sizeof *args) return EINVAL; Index: src/sys/nfs/nfs_vfsops.c diff -u src/sys/nfs/nfs_vfsops.c:1.220 src/sys/nfs/nfs_vfsops.c:1.220.14.1 --- src/sys/nfs/nfs_vfsops.c:1.220 Mon Oct 24 11:43:30 2011 +++ src/sys/nfs/nfs_vfsops.c Mon Apr 21 10:15:36 2014 @@ -1,4 +1,4 @@ -/* $NetBSD: nfs_vfsops.c,v 1.220 2011/10/24 11:43:30 hannken Exp $ */ +/* $NetBSD: nfs_vfsops.c,v 1.220.14.1 2014/04/21 10:15:36 bouyer Exp $ */ /* * Copyright (c) 1989, 1993, 1995 @@ -35,7 +35,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: nfs_vfsops.c,v 1.220 2011/10/24 11:43:30 hannken Exp $"); +__KERNEL_RCSID(0, "$NetBSD: nfs_vfsops.c,v 1.220.14.1 2014/04/21 10:15:36 bouyer Exp $"); #if defined(_KERNEL_OPT) #include "opt_nfs.h" @@ -600,6 +600,8 @@ nfs_mount(struct mount *mp, const char * size_t len; u_char *nfh; + if (args == NULL) + return EINVAL; if (*data_len < sizeof *args) return EINVAL; Index: src/sys/ufs/chfs/chfs_vfsops.c diff -u src/sys/ufs/chfs/chfs_vfsops.c:1.2 src/sys/ufs/chfs/chfs_vfsops.c:1.2.8.1 --- src/sys/ufs/chfs/chfs_vfsops.c:1.2 Thu Nov 24 21:09:37 2011 +++ src/sys/ufs/chfs/chfs_vfsops.c Mon Apr 21 10:15:36 2014 @@ -1,4 +1,4 @@ -/* $NetBSD: chfs_vfsops.c,v 1.2 2011/11/24 21:09:37 agc Exp $ */ +/* $NetBSD: chfs_vfsops.c,v 1.2.8.1 2014/04/21 10:15:36 bouyer Exp $ */ /*- * Copyright (c) 2010 Department of Software Engineering, @@ -133,6 +133,8 @@ chfs_mount(struct mount *mp, dbg("mount()\n"); + if (args == NULL) + return EINVAL; if (*data_len < sizeof *args) return EINVAL; Index: src/sys/ufs/ext2fs/ext2fs_vfsops.c diff -u src/sys/ufs/ext2fs/ext2fs_vfsops.c:1.162 src/sys/ufs/ext2fs/ext2fs_vfsops.c:1.162.10.1 --- src/sys/ufs/ext2fs/ext2fs_vfsops.c:1.162 Mon Nov 14 18:35:14 2011 +++ src/sys/ufs/ext2fs/ext2fs_vfsops.c Mon Apr 21 10:15:36 2014 @@ -1,4 +1,4 @@ -/* $NetBSD: ext2fs_vfsops.c,v 1.162 2011/11/14 18:35:14 hannken Exp $ */ +/* $NetBSD: ext2fs_vfsops.c,v 1.162.10.1 2014/04/21 10:15:36 bouyer Exp $ */ /* * Copyright (c) 1989, 1991, 1993, 1994 @@ -60,7 +60,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: ext2fs_vfsops.c,v 1.162 2011/11/14 18:35:14 hannken Exp $"); +__KERNEL_RCSID(0, "$NetBSD: ext2fs_vfsops.c,v 1.162.10.1 2014/04/21 10:15:36 bouyer Exp $"); #if defined(_KERNEL_OPT) #include "opt_compat_netbsd.h" @@ -315,6 +315,8 @@ ext2fs_mount(struct mount *mp, const cha int error = 0, flags, update; mode_t accessmode; + if (args == NULL) + return EINVAL; if (*data_len < sizeof *args) return EINVAL; Index: src/sys/ufs/ffs/ffs_vfsops.c diff -u src/sys/ufs/ffs/ffs_vfsops.c:1.275.2.2 src/sys/ufs/ffs/ffs_vfsops.c:1.275.2.2.2.1 --- src/sys/ufs/ffs/ffs_vfsops.c:1.275.2.2 Thu Sep 13 22:27:43 2012 +++ src/sys/ufs/ffs/ffs_vfsops.c Mon Apr 21 10:15:36 2014 @@ -1,4 +1,4 @@ -/* $NetBSD: ffs_vfsops.c,v 1.275.2.2 2012/09/13 22:27:43 riz Exp $ */ +/* $NetBSD: ffs_vfsops.c,v 1.275.2.2.2.1 2014/04/21 10:15:36 bouyer Exp $ */ /*- * Copyright (c) 2008, 2009 The NetBSD Foundation, Inc. @@ -61,7 +61,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: ffs_vfsops.c,v 1.275.2.2 2012/09/13 22:27:43 riz Exp $"); +__KERNEL_RCSID(0, "$NetBSD: ffs_vfsops.c,v 1.275.2.2.2.1 2014/04/21 10:15:36 bouyer Exp $"); #if defined(_KERNEL_OPT) #include "opt_ffs.h" @@ -329,6 +329,8 @@ ffs_mount(struct mount *mp, const char * int error = 0, flags, update; mode_t accessmode; + if (args == NULL) + return EINVAL; if (*data_len < sizeof *args) return EINVAL; Index: src/sys/ufs/lfs/lfs_vfsops.c diff -u src/sys/ufs/lfs/lfs_vfsops.c:1.293.2.1 src/sys/ufs/lfs/lfs_vfsops.c:1.293.2.1.4.1 --- src/sys/ufs/lfs/lfs_vfsops.c:1.293.2.1 Sat Mar 17 17:40:07 2012 +++ src/sys/ufs/lfs/lfs_vfsops.c Mon Apr 21 10:15:37 2014 @@ -1,4 +1,4 @@ -/* $NetBSD: lfs_vfsops.c,v 1.293.2.1 2012/03/17 17:40:07 bouyer Exp $ */ +/* $NetBSD: lfs_vfsops.c,v 1.293.2.1.4.1 2014/04/21 10:15:37 bouyer Exp $ */ /*- * Copyright (c) 1999, 2000, 2001, 2002, 2003, 2007, 2007 @@ -61,7 +61,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: lfs_vfsops.c,v 1.293.2.1 2012/03/17 17:40:07 bouyer Exp $"); +__KERNEL_RCSID(0, "$NetBSD: lfs_vfsops.c,v 1.293.2.1.4.1 2014/04/21 10:15:37 bouyer Exp $"); #if defined(_KERNEL_OPT) #include "opt_lfs.h" @@ -650,6 +650,8 @@ lfs_mount(struct mount *mp, const char * int error = 0, update; mode_t accessmode; + if (args == NULL) + return EINVAL; if (*data_len < sizeof *args) return EINVAL; Index: src/sys/ufs/mfs/mfs_vfsops.c diff -u src/sys/ufs/mfs/mfs_vfsops.c:1.103 src/sys/ufs/mfs/mfs_vfsops.c:1.103.14.1 --- src/sys/ufs/mfs/mfs_vfsops.c:1.103 Sun Jun 12 03:36:01 2011 +++ src/sys/ufs/mfs/mfs_vfsops.c Mon Apr 21 10:15:36 2014 @@ -1,4 +1,4 @@ -/* $NetBSD: mfs_vfsops.c,v 1.103 2011/06/12 03:36:01 rmind Exp $ */ +/* $NetBSD: mfs_vfsops.c,v 1.103.14.1 2014/04/21 10:15:36 bouyer Exp $ */ /* * Copyright (c) 1989, 1990, 1993, 1994 @@ -32,7 +32,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: mfs_vfsops.c,v 1.103 2011/06/12 03:36:01 rmind Exp $"); +__KERNEL_RCSID(0, "$NetBSD: mfs_vfsops.c,v 1.103.14.1 2014/04/21 10:15:36 bouyer Exp $"); #if defined(_KERNEL_OPT) #include "opt_compat_netbsd.h" @@ -257,6 +257,8 @@ mfs_mount(struct mount *mp, const char * struct proc *p; int flags, error = 0; + if (args == NULL) + return EINVAL; if (*data_len < sizeof *args) return EINVAL;