Date: Wed, 11 Jul 2007 18:24:04 GMT From: Eric Youngblut <eric.youngblut@isilon.com> To: freebsd-gnats-submit@FreeBSD.org Subject: kern/114506: nfs_readdirrpc doesn't use copyout to write out dirents Message-ID: <200707111824.l6BIO4gP004966@www.freebsd.org> Resent-Message-ID: <200707111830.l6BIU4Q1000271@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 114506
>Category: kern
>Synopsis: nfs_readdirrpc doesn't use copyout to write out dirents
>Confidential: no
>Severity: serious
>Priority: medium
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Wed Jul 11 18:30:04 GMT 2007
>Closed-Date:
>Last-Modified:
>Originator: Eric Youngblut
>Release: FreeBSD HEAD
>Organization:
Isilon Systems
>Environment:
>Description:
/*
* Readdir rpc call.
* Called from below the buffer cache by nfs_doio().
*/
int
nfs_readdirrpc(struct vnode *vp, struct uio *uiop, struct ucred *cred)
{
...
dp = (struct dirent *)uiop->uio_iov->iov_base;
dp->d_fileno = fileno;
dp->d_snapid = 0;
dp->d_namlen = len;
dp->d_reclen = tlen + DIRHDSIZ;
dp->d_type = DT_UNKNOWN;
This needs to be a call to uiomove() which will do a copyout() into the user-space memory.
>How-To-Repeat:
>Fix:
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200707111824.l6BIO4gP004966>