svn commit: r348067 - head/sys/kern

[Conrad Meyer]

Author: cem
Date: Tue May 21 21:26:14 2019
New Revision: 348067
URL: https://svnweb.freebsd.org/changeset/base/348067

Log:
  mqueuefs: Do not allow manipulation of the pseudo-dirents "." and ".."
  
  "." and ".." names are not maintained in the mqueuefs dirent datastructure and
  cannot be opened as mqueues.  Creating or removing them is invalid; return
  EINVAL instead of crashing.
  
  PR:		236836
  Submitted by:	Torbjørn Birch Moltu <t.b.moltu AT lyse.net>
  Discussed with:	jilles (earlier version)

Modified:
  head/sys/kern/uipc_mqueue.c

Modified: head/sys/kern/uipc_mqueue.c
==============================================================================
--- head/sys/kern/uipc_mqueue.c	Tue May 21 21:22:43 2019	(r348066)
+++ head/sys/kern/uipc_mqueue.c	Tue May 21 21:26:14 2019	(r348067)
@@ -2042,6 +2042,12 @@ kern_kmq_open(struct thread *td, const char *upath, in
 	len = strlen(path);
 	if (len < 2 || path[0] != '/' || strchr(path + 1, '/') != NULL)
 		return (EINVAL);
+	/*
+	 * "." and ".." are magic directories, populated on the fly, and cannot
+	 * be opened as queues.
+	 */
+	if (strcmp(path, "/.") == 0 || strcmp(path, "/..") == 0)
+		return (EINVAL);
 	AUDIT_ARG_UPATH1_CANON(path);
 
 	error = falloc(td, &fp, &fd, O_CLOEXEC);
@@ -2141,6 +2147,8 @@ sys_kmq_unlink(struct thread *td, struct kmq_unlink_ar
 
 	len = strlen(path);
 	if (len < 2 || path[0] != '/' || strchr(path + 1, '/') != NULL)
+		return (EINVAL);
+	if (strcmp(path, "/.") == 0 || strcmp(path, "/..") == 0)
 		return (EINVAL);
 	AUDIT_ARG_UPATH1_CANON(path);