Bug 196483 - [patch] change vfs_setopt{,_part}(...)'s len parameter to fix possible DoS
Summary: [patch] change vfs_setopt{,_part}(...)'s len parameter to fix possible DoS
Status: Open
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: 10.1-STABLE
Hardware: Any Any
: --- Affects Some People
Assignee: freebsd-bugs mailing list
Depends on:
Reported: 2015-01-04 13:32 UTC by Oliver Pinter
Modified: 2015-05-18 02:13 UTC (History)
7 users (show)

See Also:

0001-HBSD-change-vfs_setopt-_part-.-s-len-type-to-check-b.patch (1.90 KB, patch)
2015-01-04 13:32 UTC, Oliver Pinter
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Oliver Pinter freebsd_committer 2015-01-04 13:32:07 UTC
Created attachment 151321 [details]

The bcopy(...) expected size_t (aka unsigned) len parameter, but in vfs_setopt{,_part}(...) the len parameter is signed, which will cause possible DoS in some scenarios.

After this change, the vfs_setopt{,_part}(...) function properly checks the constraints.
Comment 2 Sean Bruno freebsd_committer 2015-05-07 15:44:33 UTC
I cannot comment on this ticket, lets get people who have stronger vfs knowledge to revisit this patch.
Comment 3 Kirk McKusick freebsd_committer 2015-05-18 02:13:49 UTC
Comment on attachment 151321 [details]

I agree with the sentiment reported here. But it is incomplete. The type of the len field declared in struct vfsopt (declared in sys/mount.h) needs to be changed to size_t. Also the type of field len in struct mntarg (declared in kern/vfs_mount.c)
needs to be changed to size_t. Another function that needs to have its len parameter changed to size_t is vfs_copyopt. In short, a pass needs to be made over kern/vfs_mount.c to make the use of len consistent throughout. Then the callers of the affected functions need to ensure that they are calling with appropriate parameters.