Author: trasz
Date: Sat Mar 18 23:55:50 2017
New Revision: 315519
URL: https://svnweb.freebsd.org/changeset/base/315519
Log:
MFC r311284:
Fix bug that would result in a kernel crash in some cases involving
a symlink and an autofs mount request. The crash was caused by namei()
calling bcopy() with a negative length, caused by numeric underflow:
in lookup(), in the relookup path, the ni_pathlen was decremented too
many times. The bug was introduced in r296715.
Big thanks to Alex Deiter for his help with debugging this.
Modified:
stable/11/sys/kern/vfs_lookup.c
Directory Properties:
stable/11/ (props changed)
Modified: stable/11/sys/kern/vfs_lookup.c
==============================================================================
--- stable/11/sys/kern/vfs_lookup.c Sat Mar 18 23:37:00 2017
(r315518)
+++ stable/11/sys/kern/vfs_lookup.c Sat Mar 18 23:55:50 2017
(r315519)
@@ -622,11 +622,13 @@ needs_exclusive_leaf(struct mount *mp, i
int
lookup(struct nameidata *ndp)
{
- char *cp; /* pointer into pathname argument */
+ char *cp; /* pointer into pathname argument */
+ char *prev_ni_next; /* saved ndp->ni_next */
struct vnode *dp = NULL; /* the directory we are searching */
struct vnode *tdp; /* saved dp */
struct mount *mp; /* mount table entry */
struct prison *pr;
+ size_t prev_ni_pathlen; /* saved ndp->ni_pathlen */
int docache; /* == 0 do not cache last component */
int wantparent; /* 1 => wantparent or lockparent flag */
int rdonly; /* lookup read-only flag bit */
@@ -688,7 +690,11 @@ dirloop:
printf("{%s}: ", cnp->cn_nameptr);
*cp = c; }
#endif
+ prev_ni_pathlen = ndp->ni_pathlen;
ndp->ni_pathlen -= cnp->cn_namelen;
+ KASSERT(ndp->ni_pathlen <= PATH_MAX,
+ ("%s: ni_pathlen underflow to %zd\n", __func__, ndp->ni_pathlen));
+ prev_ni_next = ndp->ni_next;
ndp->ni_next = cp;
/*
@@ -1009,6 +1015,8 @@ nextname:
("lookup: invalid path state."));
if (relookup) {
relookup = 0;
+ ndp->ni_pathlen = prev_ni_pathlen;
+ ndp->ni_next = prev_ni_next;
if (ndp->ni_dvp != dp)
vput(ndp->ni_dvp);
else
_______________________________________________
[email protected] mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "[email protected]"
