CVS commit: [netbsd-5-2] src/sys/miscfs/umapfs

["SAITOH Masanobu" <msaitoh%netbsd.org@localhost>]

Module Name:    src
Committed By:   msaitoh
Date:           Wed Aug 27 06:04:00 UTC 2014

Modified Files:
        src/sys/miscfs/umapfs [netbsd-5-2]: umap_vfsops.c

Log Message:
Pull up following revision(s) (requested by maxv in ticket #1921):
        sys/miscfs/umapfs/umap_vfsops.c: revision 1.94
1) 'error' is returned while it does not even hold an error code. Which
   means that zero is returned, and the kernel keeps mounting (and it
   probably ends up in a deadlock/memory corruption somewhere).
2) 'nentries' and 'gnentries' are int and user-controlled, and there's no
   check to ensure they are greater than zero. Since they are used to
   compute the size of two copyin's, a user can control the copied size
   by giving a negative value (like 128-2^29), and thus overwrite kernel
   memory.
Both triggerable from root only.


To generate a diff of this commit:
cvs rdiff -u -r1.80.16.1 -r1.80.16.2 src/sys/miscfs/umapfs/umap_vfsops.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.