Date: Tue, 21 May 2019 21:26:14 +0000 (UTC) From: Conrad Meyer <cem@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r348067 - head/sys/kern Message-ID: <201905212126.x4LLQEhS042066@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: cem Date: Tue May 21 21:26:14 2019 New Revision: 348067 URL: https://svnweb.freebsd.org/changeset/base/348067 Log: mqueuefs: Do not allow manipulation of the pseudo-dirents "." and ".." "." and ".." names are not maintained in the mqueuefs dirent datastructure and cannot be opened as mqueues. Creating or removing them is invalid; return EINVAL instead of crashing. PR: 236836 Submitted by: Torbjørn Birch Moltu <t.b.moltu AT lyse.net> Discussed with: jilles (earlier version) Modified: head/sys/kern/uipc_mqueue.c Modified: head/sys/kern/uipc_mqueue.c ============================================================================== --- head/sys/kern/uipc_mqueue.c Tue May 21 21:22:43 2019 (r348066) +++ head/sys/kern/uipc_mqueue.c Tue May 21 21:26:14 2019 (r348067) @@ -2042,6 +2042,12 @@ kern_kmq_open(struct thread *td, const char *upath, in len = strlen(path); if (len < 2 || path[0] != '/' || strchr(path + 1, '/') != NULL) return (EINVAL); + /* + * "." and ".." are magic directories, populated on the fly, and cannot + * be opened as queues. + */ + if (strcmp(path, "/.") == 0 || strcmp(path, "/..") == 0) + return (EINVAL); AUDIT_ARG_UPATH1_CANON(path); error = falloc(td, &fp, &fd, O_CLOEXEC); @@ -2141,6 +2147,8 @@ sys_kmq_unlink(struct thread *td, struct kmq_unlink_ar len = strlen(path); if (len < 2 || path[0] != '/' || strchr(path + 1, '/') != NULL) + return (EINVAL); + if (strcmp(path, "/.") == 0 || strcmp(path, "/..") == 0) return (EINVAL); AUDIT_ARG_UPATH1_CANON(path);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201905212126.x4LLQEhS042066>