Re: Root can panic kernel with mknod on a tmpfs filesystem

[Marc Espie]

E.g., this should be equivalent.

Index: tmpfs_vnops.c
===================================================================
RCS file: /build/data/openbsd/cvs/src/sys/tmpfs/tmpfs_vnops.c,v
retrieving revision 1.27
diff -u -p -r1.27 tmpfs_vnops.c
--- tmpfs_vnops.c       19 Jun 2016 11:54:33 -0000      1.27
+++ tmpfs_vnops.c       6 Jul 2016 08:00:34 -0000
@@ -339,7 +339,8 @@ tmpfs_mknod(void *v)
        enum vtype vt = vap->va_type;
        int error;
 
-       if (vt != VBLK && vt != VCHR && vt != VFIFO) {
+       if ((vt != VBLK && vt != VCHR && vt != VFIFO) || 
+           (vt != VFIFO && vap->va_rdev == VNOVAL)) {
                vput(dvp);
                return EINVAL;
        }