Date: Thu, 4 May 2017 20:42:31 +0000 (UTC) From: Gleb Smirnoff <glebius@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r317806 - head/sys/dev/nand Message-ID: <201705042042.v44KgV0u056209@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: glebius Date: Thu May 4 20:42:31 2017 New Revision: 317806 URL: https://svnweb.freebsd.org/changeset/base/317806 Log: The nandsim(4) simulator driver doesn't have any protection against races at least in its ioctl handler, and at the same time it creates device entry with 0666 permissions. To plug possible issues in it: - Mark it as needing Giant. - Switch device mode to 0600. Submitted by: C Turt Reviewed by: imp MFC after: 1 week Security: Possible double free in ioctl handler Modified: head/sys/dev/nand/nandsim.c Modified: head/sys/dev/nand/nandsim.c ============================================================================== --- head/sys/dev/nand/nandsim.c Thu May 4 19:55:32 2017 (r317805) +++ head/sys/dev/nand/nandsim.c Thu May 4 20:42:31 2017 (r317806) @@ -71,6 +71,7 @@ static struct nandsim_chip *get_nandsim_ static struct cdevsw nandsim_cdevsw = { .d_version = D_VERSION, + .d_flags = D_NEEDGIANT, .d_ioctl = nandsim_ioctl, .d_name = "nandsim", }; @@ -639,7 +640,7 @@ nandsim_modevent(module_t mod __unused, switch (type) { case MOD_LOAD: nandsim_dev = make_dev(&nandsim_cdevsw, 0, - UID_ROOT, GID_WHEEL, 0666, "nandsim.ioctl"); + UID_ROOT, GID_WHEEL, 0600, "nandsim.ioctl"); break; case MOD_UNLOAD: for (i = 0; i < MAX_SIM_DEV; i++) {
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201705042042.v44KgV0u056209>