[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
CVS commit: [netbsd-6-0] src/sys
Module Name: src
Committed By: msaitoh
Date: Wed Aug 27 14:59:22 UTC 2014
src/sys/fs/ptyfs [netbsd-6-0]: ptyfs_vfsops.c
src/sys/miscfs/umapfs [netbsd-6-0]: umap_vfsops.c
Pull up following revision(s) (requested by maxv in ticket #1115):
sys/miscfs/umapfs/umap_vfsops.c: revision 1.94
sys/fs/ptyfs/ptyfs_vfsops.c: revision 1.52
Overflow if *data_len == OSIZE and args->version >= PTYFS_ARGSVERSION.
Sent on tech-kern@, ok christos@
1) 'error' is returned while it does not even hold an error code. Which
means that zero is returned, and the kernel keeps mounting (and it
probably ends up in a deadlock/memory corruption somewhere).
2) 'nentries' and 'gnentries' are int and user-controlled, and there's no
check to ensure they are greater than zero. Since they are used to
compute the size of two copyin's, a user can control the copied size
by giving a negative value (like 128-2^29), and thus overwrite kernel
Both triggerable from root only.
To generate a diff of this commit:
cvs rdiff -u -r22.214.171.124.2.1 -r126.96.36.199.2.2 src/sys/fs/ptyfs/ptyfs_vfsops.c
cvs rdiff -u -r188.8.131.52 -r184.108.40.206 src/sys/miscfs/umapfs/umap_vfsops.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Main Index |
Thread Index |