Aren/NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Sanity check negative values in the maximum size and number of nodes

Browse Source 
arguments to avoid a crash while mounting a tmpfs file system.  Add a
regression test for this too.  Noticed by chs@.
This commit is contained in:
jmmv 2005-09-25 16:28:43 +00:00
parent a626c5afb2
commit b35a89f13c
2 changed files with 12 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
regress/sys/fs/tmpfs/t_mount
View File

@ -1,6 +1,6 @@
#!/bin/sh
#
# $NetBSD: t_mount,v 1.2 2005/09/23 15:36:15 jmmv Exp $
# $NetBSD: t_mount,v 1.3 2005/09/25 16:28:43 jmmv Exp $
#
# Copyright (c) 2005 The NetBSD Foundation, Inc.
# All rights reserved.
@ -65,6 +65,10 @@ test_run() {
[ ${st_gid} = 100 ] || die
[ ${st_mode} = 040755 ] || die
test_unmount
test_name "Negative values are correctly handled"
test_mount -o "-s -10"
test_unmount
}
. ./h_funcs.subr

12
sys/fs/tmpfs/tmpfs_vfsops.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: tmpfs_vfsops.c,v 1.6 2005/09/23 15:36:15 jmmv Exp $ */
/* $NetBSD: tmpfs_vfsops.c,v 1.7 2005/09/25 16:28:43 jmmv Exp $ */
/*
* Copyright (c) 2005 The NetBSD Foundation, Inc.
@ -49,7 +49,7 @@
*/
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: tmpfs_vfsops.c,v 1.6 2005/09/23 15:36:15 jmmv Exp $");
__KERNEL_RCSID(0, "$NetBSD: tmpfs_vfsops.c,v 1.7 2005/09/25 16:28:43 jmmv Exp $");
#include <sys/param.h>
#include <sys/types.h>
@ -140,16 +140,18 @@ tmpfs_mount(struct mount *mp, const char *path, void *data,
* allowed to use, based on the maximum size the user passed in
* the mount structure. A value of zero is treated as if the
* maximum available space was requested. */
if (args.ta_size_max == 0)
if (args.ta_size_max < PAGE_SIZE)
pages = SIZE_MAX;
else
pages = args.ta_size_max / PAGE_SIZE +
(args.ta_size_max % PAGE_SIZE == 0 ? 0 : 1);
KASSERT(pages > 0);
if (args.ta_nodes_max == 0)
nodes = pages * PAGE_SIZE / 1024;
if (args.ta_nodes_max <= 3)
nodes = 3 + pages * PAGE_SIZE / 1024;
else
nodes = args.ta_nodes_max;
KASSERT(nodes >= 3);
/* Allocate the tmpfs mount structure and fill it. */
tmp = (struct tmpfs_mount *)malloc(sizeof(struct tmpfs_mount),