Tim Newsham wrote:
> The tmpfs filesystem allows the mounting user to specify a
> username, a groupname or a device name for the root node of
> the filesystem. A user that specifies a value of VNOVAL for
> any of these fields will trigger an assert in tmpfs_alloc_node():
>
> /* XXX pedro: we should check for UID_MAX and GID_MAX instead. */
> KASSERT(uid != VNOVAL && gid != VNOVAL && mode != VNOVAL);
sigh. i don't know what else can trigger that kassert, so just fix the caller
to do the same check and return an error.
Index: tmpfs_vfsops.c
===================================================================
RCS file: /cvs/src/sys/tmpfs/tmpfs_vfsops.c,v
retrieving revision 1.8
diff -u -p -r1.8 tmpfs_vfsops.c
--- tmpfs_vfsops.c 13 Jan 2016 13:01:40 -0000 1.8
+++ tmpfs_vfsops.c 11 Jul 2016 20:37:30 -0000
@@ -125,6 +125,9 @@ tmpfs_mount(struct mount *mp, const char
error = copyin(data, &args, sizeof(struct tmpfs_args));
if (error)
return error;
+ if (args.ta_root_uid == VNOVAL || args.ta_root_gid == VNOVAL ||
+ (args.ta_root_mode & ALLPERMS) == VNOVAL)
+ return EINVAL;
/* Get the memory usage limit for this file-system. */
if (args.ta_size_max < PAGE_SIZE) {
