Aren
/
NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Pull up following revision(s) (requested by riastradh in ticket #1691): 

sys/fs/tmpfs/tmpfs_subr.c: revision 1.116
	sys/fs/tmpfs/tmpfs_subr.c: revision 1.117

tmpfs: Refuse sizes that overflow round_page.

tmpfs: Assert no arithmetic overflow in directory node tn_size.
Need >2^57 directory entries before this is a problem.  If we created
a million per second, this would take over 4000 years.
This commit is contained in:
martin 2023-08-01 15:30:40 +00:00
parent bb8cfbb658
commit cb6e16d456
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
sys/fs/tmpfs/tmpfs_subr.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: tmpfs_subr.c,v 1.104 2019/01/01 10:06:54 hannken Exp $ */
/* $NetBSD: tmpfs_subr.c,v 1.104.4.1 2023/08/01 15:30:40 martin Exp $ */
/*
* Copyright (c) 2005-2013 The NetBSD Foundation, Inc.
@ -73,7 +73,7 @@
*/
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: tmpfs_subr.c,v 1.104 2019/01/01 10:06:54 hannken Exp $");
__KERNEL_RCSID(0, "$NetBSD: tmpfs_subr.c,v 1.104.4.1 2023/08/01 15:30:40 martin Exp $");
#include <sys/param.h>
#include <sys/cprng.h>
@ -514,6 +514,7 @@ tmpfs_dir_attach(tmpfs_node_t *dnode, tmpfs_dirent_t *de, tmpfs_node_t *node)
/* Insert the entry to the directory (parent of inode). */
TAILQ_INSERT_TAIL(&dnode->tn_spec.tn_dir.tn_dir, de, td_entries);
KASSERT(dnode->tn_size <= __type_max(off_t) - sizeof(tmpfs_dirent_t));
dnode->tn_size += sizeof(tmpfs_dirent_t);
uvm_vnp_setsize(dvp, dnode->tn_size);
@ -580,6 +581,7 @@ tmpfs_dir_detach(tmpfs_node_t *dnode, tmpfs_dirent_t *de)
dnode->tn_spec.tn_dir.tn_readdir_lastp = NULL;
}
TAILQ_REMOVE(&dnode->tn_spec.tn_dir.tn_dir, de, td_entries);
KASSERT(dnode->tn_size >= sizeof(tmpfs_dirent_t));
dnode->tn_size -= sizeof(tmpfs_dirent_t);
tmpfs_dir_putseq(dnode, de);
@ -908,6 +910,9 @@ tmpfs_reg_resize(struct vnode *vp, off_t newsize)
KASSERT(vp->v_type == VREG);
KASSERT(newsize >= 0);
if (newsize > __type_max(off_t) - PAGE_SIZE + 1)
return EFBIG;
oldsize = node->tn_size;
oldpages = round_page(oldsize) >> PAGE_SHIFT;
newpages = round_page(newsize) >> PAGE_SHIFT;