Re: Root can panic kernel with mknod on a tmpfs filesystem

[Ted Unangst]

Tim Newsham wrote:
> Recommendation:
> Validate the device number vap->va_rdev in tmpfs_mknod() and return
> an error if it is VNOVAL (-1).

Sounds about right to me.

Index: tmpfs_vnops.c
===================================================================
RCS file: /cvs/src/sys/tmpfs/tmpfs_vnops.c,v
retrieving revision 1.27
diff -u -p -r1.27 tmpfs_vnops.c
--- tmpfs_vnops.c       19 Jun 2016 11:54:33 -0000      1.27
+++ tmpfs_vnops.c       5 Jul 2016 23:20:33 -0000
@@ -343,6 +343,10 @@ tmpfs_mknod(void *v)
                vput(dvp);
                return EINVAL;
        }
+       if ((vt == VBLK || vt == VCHR) && vap->va_rdev == VNOVAL) {
+               vput(dvp);
+               return EINVAL;
+       }
 
        /* tmpfs_alloc_file() will unlock 'dvp'. */
        error = tmpfs_alloc_file(dvp, vpp, vap, cnp, NULL);