[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
CVS commit: [netbsd-5] src/sys/miscfs/umapfs
Module Name: src
Committed By: msaitoh
Date: Wed Aug 27 06:02:48 UTC 2014
src/sys/miscfs/umapfs [netbsd-5]: umap_vfsops.c
Pull up following revision(s) (requested by maxv in ticket #1921):
sys/miscfs/umapfs/umap_vfsops.c: revision 1.94
1) 'error' is returned while it does not even hold an error code. Which
means that zero is returned, and the kernel keeps mounting (and it
probably ends up in a deadlock/memory corruption somewhere).
2) 'nentries' and 'gnentries' are int and user-controlled, and there's no
check to ensure they are greater than zero. Since they are used to
compute the size of two copyin's, a user can control the copied size
by giving a negative value (like 128-2^29), and thus overwrite kernel
Both triggerable from root only.
To generate a diff of this commit:
cvs rdiff -u -r220.127.116.11 -r18.104.22.168 src/sys/miscfs/umapfs/umap_vfsops.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Main Index |
Thread Index |