Skip site navigation (1)Skip section navigation (2)
Date:      Sun, 5 Feb 2012 10:59:50 +0000 (UTC)
From:      Martin Matuska <mm@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org
Subject:   svn commit: r231012 - head/sys/kern
Message-ID:  <201202051059.q15AxoaY079844@svn.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: mm
Date: Sun Feb  5 10:59:50 2012
New Revision: 231012
URL: http://svn.freebsd.org/changeset/base/231012

Log:
  Analogous to r230407 a separate path buffer in vfs_mount.c is required
  for r230129. Fixes a out of bounds write to fspath.
  
  MFC after:	10 days

Modified:
  head/sys/kern/vfs_mount.c

Modified: head/sys/kern/vfs_mount.c
==============================================================================
--- head/sys/kern/vfs_mount.c	Sun Feb  5 09:17:49 2012	(r231011)
+++ head/sys/kern/vfs_mount.c	Sun Feb  5 10:59:50 2012	(r231012)
@@ -1039,6 +1039,7 @@ vfs_domount(
 	struct vfsconf *vfsp;
 	struct nameidata nd;
 	struct vnode *vp;
+	char *pathbuf;
 	int error;
 
 	/*
@@ -1102,12 +1103,15 @@ vfs_domount(
 	NDFREE(&nd, NDF_ONLY_PNBUF);
 	vp = nd.ni_vp;
 	if ((fsflags & MNT_UPDATE) == 0) {
-		error = vn_path_to_global_path(td, vp, fspath, MNAMELEN);
+		pathbuf = malloc(MNAMELEN, M_TEMP, M_WAITOK);
+		strcpy(pathbuf, fspath);
+		error = vn_path_to_global_path(td, vp, pathbuf, MNAMELEN);
 		/* debug.disablefullpath == 1 results in ENODEV */
 		if (error == 0 || error == ENODEV) {
-			error = vfs_domount_first(td, vfsp, fspath, vp,
+			error = vfs_domount_first(td, vfsp, pathbuf, vp,
 			    fsflags, optlist);
 		}
+		free(pathbuf, M_TEMP);
 	} else
 		error = vfs_domount_update(td, vp, fsflags, optlist);
 	mtx_unlock(&Giant);



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201202051059.q15AxoaY079844>