maxv 83fce8c371 1) 'error' is returned while it does not even hold an error code. Which ... means that zero is returned, and the kernel keeps mounting (and it probably ends up in a deadlock/memory corruption somewhere). 2) 'nentries' and 'gnentries' are int and user-controlled, and there's no check to ensure they are greater than zero. Since they are used to compute the size of two copyin's, a user can control the copied size by giving a negative value (like 128-2^29), and thus overwrite kernel memory. Both triggerable from root only.		2014-08-11 14:02:14 +00:00
..
files.umapfs
Makefile
umap_subr.c	ansify function definitions	2009-03-15 17:14:40 +00:00
umap_vfsops.c	1) 'error' is returned while it does not even hold an error code. Which	2014-08-11 14:02:14 +00:00
umap_vnops.c	The current implementation of vn_lock() is racy. Modification of	2014-02-27 16:51:37 +00:00
umap.h	Create sysctl entries during module initialisation and destroy them	2008-06-28 01:34:05 +00:00