Module Name: src
Committed By: maxv
Date: Mon Aug 11 14:02:14 UTC 2014
Modified Files:
src/sys/miscfs/umapfs: umap_vfsops.c
Log Message:
1) 'error' is returned while it does not even hold an error code. Which
means that zero is returned, and the kernel keeps mounting (and it
probably ends up in a deadlock/memory corruption somewhere).
2) 'nentries' and 'gnentries' are int and user-controlled, and there's no
check to ensure they are greater than zero. Since they are used to
compute the size of two copyin's, a user can control the copied size
by giving a negative value (like 128-2^29), and thus overwrite kernel
memory.
Both triggerable from root only.
To generate a diff of this commit:
cvs rdiff -u -r1.93 -r1.94 src/sys/miscfs/umapfs/umap_vfsops.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/miscfs/umapfs/umap_vfsops.c
diff -u src/sys/miscfs/umapfs/umap_vfsops.c:1.93 src/sys/miscfs/umapfs/umap_vfsops.c:1.94
--- src/sys/miscfs/umapfs/umap_vfsops.c:1.93 Sun May 25 13:51:25 2014
+++ src/sys/miscfs/umapfs/umap_vfsops.c Mon Aug 11 14:02:14 2014
@@ -1,4 +1,4 @@
-/* $NetBSD: umap_vfsops.c,v 1.93 2014/05/25 13:51:25 hannken Exp $ */
+/* $NetBSD: umap_vfsops.c,v 1.94 2014/08/11 14:02:14 maxv Exp $ */
/*
* Copyright (c) 1992, 1993
@@ -41,7 +41,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: umap_vfsops.c,v 1.93 2014/05/25 13:51:25 hannken Exp $");
+__KERNEL_RCSID(0, "$NetBSD: umap_vfsops.c,v 1.94 2014/08/11 14:02:14 maxv Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@@ -153,9 +153,10 @@ umapfs_mount(struct mount *mp, const cha
/*
* Now copy in the number of entries and maps for umap mapping.
*/
- if (args->nentries > MAPFILEENTRIES || args->gnentries > GMAPFILEENTRIES) {
+ if (args->nentries < 0 || args->nentries > MAPFILEENTRIES ||
+ args->gnentries < 0 || args->gnentries > GMAPFILEENTRIES) {
vput(lowerrootvp);
- return (error);
+ return (EINVAL);
}
amp->info_nentries = args->nentries;
