Author: cem
Date: Tue May 21 21:26:14 2019
New Revision: 348067
URL: https://svnweb.freebsd.org/changeset/base/348067
Log:
mqueuefs: Do not allow manipulation of the pseudo-dirents "." and ".."
"." and ".." names are not maintained in the mqueuefs dirent datastructure and
cannot be opened as mqueues. Creating or removing them is invalid; return
EINVAL instead of crashing.
PR: 236836
Submitted by: Torbjørn Birch Moltu <t.b.moltu AT lyse.net>
Discussed with: jilles (earlier version)
Modified:
head/sys/kern/uipc_mqueue.c
Modified: head/sys/kern/uipc_mqueue.c
==============================================================================
--- head/sys/kern/uipc_mqueue.c Tue May 21 21:22:43 2019 (r348066)
+++ head/sys/kern/uipc_mqueue.c Tue May 21 21:26:14 2019 (r348067)
@@ -2042,6 +2042,12 @@ kern_kmq_open(struct thread *td, const char *upath, in
len = strlen(path);
if (len < 2 || path[0] != '/' || strchr(path + 1, '/') != NULL)
return (EINVAL);
+ /*
+ * "." and ".." are magic directories, populated on the fly, and cannot
+ * be opened as queues.
+ */
+ if (strcmp(path, "/.") == 0 || strcmp(path, "/..") == 0)
+ return (EINVAL);
AUDIT_ARG_UPATH1_CANON(path);
error = falloc(td, &fp, &fd, O_CLOEXEC);
@@ -2141,6 +2147,8 @@ sys_kmq_unlink(struct thread *td, struct kmq_unlink_ar
len = strlen(path);
if (len < 2 || path[0] != '/' || strchr(path + 1, '/') != NULL)
+ return (EINVAL);
+ if (strcmp(path, "/.") == 0 || strcmp(path, "/..") == 0)
return (EINVAL);
AUDIT_ARG_UPATH1_CANON(path);
_______________________________________________
[email protected] mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "[email protected]"
