Bug 196483
| Summary: | [patch] change vfs_setopt{,_part}(...)'s len parameter to fix possible DoS | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Base System | Reporter: | Oliver Pinter <op> | ||||
| Component: | kern | Assignee: | freebsd-bugs (Nobody) <bugs> | ||||
| Status: | Open --- | ||||||
| Severity: | Affects Some People | CC: | alc, emaste, kib, mckusick, sbruno, thomas, trasz | ||||
| Priority: | --- | ||||||
| Version: | 10.1-STABLE | ||||||
| Hardware: | Any | ||||||
| OS: | Any | ||||||
| See Also: | https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=196474 | ||||||
| Attachments: |
|
||||||
I cannot comment on this ticket, lets get people who have stronger vfs knowledge to revisit this patch. Comment on attachment 151321 [details]
0001-HBSD-change-vfs_setopt-_part-.-s-len-type-to-check-b.patch
I agree with the sentiment reported here. But it is incomplete. The type of the len field declared in struct vfsopt (declared in sys/mount.h) needs to be changed to size_t. Also the type of field len in struct mntarg (declared in kern/vfs_mount.c)
needs to be changed to size_t. Another function that needs to have its len parameter changed to size_t is vfs_copyopt. In short, a pass needs to be made over kern/vfs_mount.c to make the use of len consistent throughout. Then the callers of the affected functions need to ensure that they are calling with appropriate parameters.
|
Created attachment 151321 [details] 0001-HBSD-change-vfs_setopt-_part-.-s-len-type-to-check-b.patch The bcopy(...) expected size_t (aka unsigned) len parameter, but in vfs_setopt{,_part}(...) the len parameter is signed, which will cause possible DoS in some scenarios. After this change, the vfs_setopt{,_part}(...) function properly checks the constraints.