From owner-svn-src-stable@FreeBSD.ORG Sun Feb 24 05:49:00 2013 Return-Path: Delivered-To: svn-src-stable@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by hub.freebsd.org (Postfix) with ESMTP id 5DA79FFC; Sun, 24 Feb 2013 05:49:00 +0000 (UTC) (envelope-from kib@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) by mx1.freebsd.org (Postfix) with ESMTP id 3827415FE; Sun, 24 Feb 2013 05:49:00 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.5/8.14.5) with ESMTP id r1O5mxqt009553; Sun, 24 Feb 2013 05:48:59 GMT (envelope-from kib@svn.freebsd.org) Received: (from kib@localhost) by svn.freebsd.org (8.14.5/8.14.5/Submit) id r1O5mxGH009552; Sun, 24 Feb 2013 05:48:59 GMT (envelope-from kib@svn.freebsd.org) Message-Id: <201302240548.r1O5mxGH009552@svn.freebsd.org> From: Konstantin Belousov Date: Sun, 24 Feb 2013 05:48:59 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-9@freebsd.org Subject: svn commit: r247211 - stable/9/sys/ufs/ffs X-SVN-Group: stable-9 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-stable@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: SVN commit messages for all the -stable branches of the src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 24 Feb 2013 05:49:00 -0000 Author: kib Date: Sun Feb 24 05:48:59 2013 New Revision: 247211 URL: http://svnweb.freebsd.org/changeset/base/247211 Log: MFC r246612: Fix several unsafe pointer dereferences in the buffered_write() function. Modified: stable/9/sys/ufs/ffs/ffs_alloc.c Directory Properties: stable/9/sys/ (props changed) Modified: stable/9/sys/ufs/ffs/ffs_alloc.c ============================================================================== --- stable/9/sys/ufs/ffs/ffs_alloc.c Sun Feb 24 03:15:43 2013 (r247210) +++ stable/9/sys/ufs/ffs/ffs_alloc.c Sun Feb 24 05:48:59 2013 (r247211) @@ -2853,10 +2853,11 @@ buffered_write(fp, uio, active_cred, fla int flags; struct thread *td; { - struct vnode *devvp; + struct vnode *devvp, *vp; struct inode *ip; struct buf *bp; struct fs *fs; + struct filedesc *fdp; int error, vfslocked; daddr_t lbn; @@ -2867,12 +2868,34 @@ buffered_write(fp, uio, active_cred, fla * within the filesystem being written. Yes, this is an ugly hack. */ devvp = fp->f_vnode; - ip = VTOI(td->td_proc->p_fd->fd_cdir); - if (ip->i_devvp != devvp) + if (!vn_isdisk(devvp, NULL)) return (EINVAL); + fdp = td->td_proc->p_fd; + FILEDESC_SLOCK(fdp); + vp = fdp->fd_cdir; + vref(vp); + FILEDESC_SUNLOCK(fdp); + vfslocked = VFS_LOCK_GIANT(vp->v_mount); + vn_lock(vp, LK_SHARED | LK_RETRY); + /* + * Check that the current directory vnode indeed belongs to + * UFS before trying to dereference UFS-specific v_data fields. + */ + if (vp->v_op != &ffs_vnodeops1 && vp->v_op != &ffs_vnodeops2) { + vput(vp); + VFS_UNLOCK_GIANT(vfslocked); + return (EINVAL); + } + ip = VTOI(vp); + if (ip->i_devvp != devvp) { + vput(vp); + VFS_UNLOCK_GIANT(vfslocked); + return (EINVAL); + } fs = ip->i_fs; + vput(vp); + VFS_UNLOCK_GIANT(vfslocked); foffset_lock_uio(fp, uio, flags); - vfslocked = VFS_LOCK_GIANT(ip->i_vnode->v_mount); vn_lock(devvp, LK_EXCLUSIVE | LK_RETRY); #ifdef DEBUG if (fsckcmds) { @@ -2900,7 +2923,6 @@ buffered_write(fp, uio, active_cred, fla error = bwrite(bp); out: VOP_UNLOCK(devvp, 0); - VFS_UNLOCK_GIANT(vfslocked); foffset_unlock_uio(fp, uio, flags | FOF_NEXTOFF); return (error); }