Author: mm
Date: Sun Mar 5 21:43:07 2017
New Revision: 314712
URL: https://svnweb.freebsd.org/changeset/base/314712
Log:
MFC r314572:
Fix null pointer dereference in zfs_freebsd_setacl().
Prevents unprivileged users from panicking the kernel by calling
__acl_delete_*() on files or directories inside a ZFS mount.
Modified:
stable/9/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_vnops.c
Directory Properties:
stable/9/ (props changed)
stable/9/sys/ (props changed)
stable/9/sys/cddl/contrib/opensolaris/ (props changed)
Modified: stable/9/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_vnops.c
==============================================================================
--- stable/9/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_vnops.c Sun Mar
5 21:42:03 2017 (r314711)
+++ stable/9/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_vnops.c Sun Mar
5 21:43:07 2017 (r314712)
@@ -6993,6 +6993,9 @@ zfs_freebsd_setacl(ap)
if (ap->a_type != ACL_TYPE_NFS4)
return (EINVAL);
+ if (ap->a_aclp == NULL)
+ return (EINVAL);
+
if (ap->a_aclp->acl_cnt < 1 || ap->a_aclp->acl_cnt > MAX_ACL_ENTRIES)
return (EINVAL);
_______________________________________________
svn-src-stable-9@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-stable-9
To unsubscribe, send any mail to "svn-src-stable-9-unsubscr...@freebsd.org"
