diff options
| author | Ryan Moeller <freqlabs@FreeBSD.org> | 2020-05-11 15:38:44 +0000 |
|---|---|---|
| committer | Ryan Moeller <freqlabs@FreeBSD.org> | 2020-05-11 15:38:44 +0000 |
| commit | e51e957e17799feae80e11da5620af1a338171e2 (patch) | |
| tree | 675a847e967ab06d0d029228561ed4f95cb558ad | |
| parent | 9287f06d0890877708d421a604c461ab6625e4f5 (diff) | |
| download | src-e51e957e17799feae80e11da5620af1a338171e2.tar.gz src-e51e957e17799feae80e11da5620af1a338171e2.zip | |
vfs_exports: Tighten bounds and assert consistency of numsecflavors
We know the value must be greater than 0 and less than MAXSECFLAVORS.
Reject values outside this range in the initial check in vfs_export and add KASSERTs
in the later consumers.
Also check that we are called with one of either MNT_DELEXPORT or MNT_EXPORTED set.
Reviewed by: rmacklem
Approved by: mav (mentor)
MFC after: 1 week
Sponsored by: iXsystems, Inc.
Differential Revision: https://reviews.freebsd.org/D24753
Notes
Notes:
svn path=/head/; revision=360900
| -rw-r--r-- | sys/kern/vfs_export.c | 20 |
1 files changed, 17 insertions, 3 deletions
diff --git a/sys/kern/vfs_export.c b/sys/kern/vfs_export.c index 669d4e9fa3bf..8a7a47233a6f 100644 --- a/sys/kern/vfs_export.c +++ b/sys/kern/vfs_export.c @@ -112,6 +112,11 @@ vfs_hang_addrlist(struct mount *mp, struct netexport *nep, #endif int error; + KASSERT(argp->ex_numsecflavors > 0, + ("%s: numsecflavors <= 0", __func__)); + KASSERT(argp->ex_numsecflavors < MAXSECFLAVORS, + ("%s: numsecflavors >= MAXSECFLAVORS", __func__)); + /* * XXX: This routine converts from a `struct xucred' * (argp->ex_anon) to a `struct ucred' (np->netc_anon). This @@ -300,8 +305,12 @@ vfs_export(struct mount *mp, struct export_args *argp) struct netexport *nep; int error; - if (argp->ex_numsecflavors < 0 - || argp->ex_numsecflavors >= MAXSECFLAVORS) + if ((argp->ex_flags & (MNT_DELEXPORT | MNT_EXPORTED)) == 0) + return (EINVAL); + + if ((argp->ex_flags & MNT_EXPORTED) != 0 && + (argp->ex_numsecflavors <= 0 + || argp->ex_numsecflavors >= MAXSECFLAVORS)) return (EINVAL); error = 0; @@ -518,8 +527,13 @@ vfs_stdcheckexp(struct mount *mp, struct sockaddr *nam, int *extflagsp, *extflagsp = np->netc_exflags; if ((*credanonp = np->netc_anon) != NULL) crhold(*credanonp); - if (numsecflavors) + if (numsecflavors) { *numsecflavors = np->netc_numsecflavors; + KASSERT(*numsecflavors > 0, + ("%s: numsecflavors <= 0", __func__)); + KASSERT(*numsecflavors < MAXSECFLAVORS, + ("%s: numsecflavors >= MAXSECFLAVORS", __func__)); + } if (secflavors) *secflavors = np->netc_secflavors; lockmgr(&mp->mnt_explock, LK_RELEASE, NULL); |