From owner-svn-src-all@FreeBSD.ORG Fri Jan 8 07:57:44 2010 Return-Path: Delivered-To: svn-src-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 08DCF106566B; Fri, 8 Jan 2010 07:57:44 +0000 (UTC) (envelope-from jh@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c]) by mx1.freebsd.org (Postfix) with ESMTP id ECB9F8FC12; Fri, 8 Jan 2010 07:57:43 +0000 (UTC) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.3/8.14.3) with ESMTP id o087vh1h009801; Fri, 8 Jan 2010 07:57:43 GMT (envelope-from jh@svn.freebsd.org) Received: (from jh@localhost) by svn.freebsd.org (8.14.3/8.14.3/Submit) id o087vhrr009799; Fri, 8 Jan 2010 07:57:43 GMT (envelope-from jh@svn.freebsd.org) Message-Id: <201001080757.o087vhrr009799@svn.freebsd.org> From: Jaakko Heinonen Date: Fri, 8 Jan 2010 07:57:43 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: Subject: svn commit: r201773 - head/sys/fs/tmpfs X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 08 Jan 2010 07:57:44 -0000 Author: jh Date: Fri Jan 8 07:57:43 2010 New Revision: 201773 URL: http://svn.freebsd.org/changeset/base/201773 Log: - Change the type of size_max to u_quad_t because its value is converted with vfs_scanopt(9) using the "%qu" format string. - Limit the maximum value of size_max to (SIZE_MAX - PAGE_SIZE) to prevent overflow in howmany() macro. PR: kern/141194 Approved by: trasz (mentor) MFC after: 2 weeks Modified: head/sys/fs/tmpfs/tmpfs_vfsops.c Modified: head/sys/fs/tmpfs/tmpfs_vfsops.c ============================================================================== --- head/sys/fs/tmpfs/tmpfs_vfsops.c Fri Jan 8 07:42:01 2010 (r201772) +++ head/sys/fs/tmpfs/tmpfs_vfsops.c Fri Jan 8 07:57:43 2010 (r201773) @@ -185,8 +185,8 @@ tmpfs_mount(struct mount *mp) ino_t nodes; int error; /* Size counters. */ - ino_t nodes_max; - size_t size_max; + ino_t nodes_max; + u_quad_t size_max; /* Root node attributes. */ uid_t root_uid; @@ -239,7 +239,7 @@ tmpfs_mount(struct mount *mp) * allowed to use, based on the maximum size the user passed in * the mount structure. A value of zero is treated as if the * maximum available space was requested. */ - if (size_max < PAGE_SIZE || size_max >= SIZE_MAX) + if (size_max < PAGE_SIZE || size_max > (SIZE_MAX - PAGE_SIZE)) pages = SIZE_MAX; else pages = howmany(size_max, PAGE_SIZE);