[src/trunk]: src/sys/fs/puffs PR/50573: Andreas Gustafsson: puffs can crash k...

[christos <christos%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/26057b85844b
branches:  trunk
changeset: 812538:26057b85844b
user:      christos <christos%NetBSD.org@localhost>
date:      Sun Dec 20 01:34:00 2015 +0000

description:
PR/50573: Andreas Gustafsson: puffs can crash kernel for lack of argument
checking

diffstat:

 sys/fs/puffs/puffs_vfsops.c |  18 ++++++++++++++++--
 1 files changed, 16 insertions(+), 2 deletions(-)

diffs (41 lines):

diff -r aeaeb152e646 -r 26057b85844b sys/fs/puffs/puffs_vfsops.c
--- a/sys/fs/puffs/puffs_vfsops.c       Sun Dec 20 01:11:22 2015 +0000
+++ b/sys/fs/puffs/puffs_vfsops.c       Sun Dec 20 01:34:00 2015 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: puffs_vfsops.c,v 1.117 2015/02/16 10:49:39 martin Exp $        */
+/*     $NetBSD: puffs_vfsops.c,v 1.118 2015/12/20 01:34:00 christos Exp $      */
 
 /*
  * Copyright (c) 2005, 2006  Antti Kantee.  All Rights Reserved.
@@ -30,7 +30,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: puffs_vfsops.c,v 1.117 2015/02/16 10:49:39 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: puffs_vfsops.c,v 1.118 2015/12/20 01:34:00 christos Exp $");
 
 #include <sys/param.h>
 #include <sys/kernel.h>
@@ -269,8 +269,22 @@
 
        /* XXX: check parameters */
        pmp->pmp_root_cookie = args->pa_root_cookie;
+       switch (args->pa_root_vtype) {
+       case VNON: case VREG: case VDIR: case VBLK:
+       case VCHR: case VLNK: case VSOCK: case VFIFO:
+               break;
+       default:
+               error = EINVAL;
+               goto out;
+       }
        pmp->pmp_root_vtype = args->pa_root_vtype;
+
+       if (args->pa_root_vsize < 0) {
+               error = EINVAL;
+               goto out;
+       }
        pmp->pmp_root_vsize = args->pa_root_vsize;
+
        pmp->pmp_root_rdev = args->pa_root_rdev;
        pmp->pmp_docompat = args->pa_time32;