svn commit: r338979 - in releng: 11.1/sys/kern 11.2/sys/kern

[Gordon Tetlow]

Author: gordon
Date: Thu Sep 27 18:32:14 2018
New Revision: 338979
URL: https://svnweb.freebsd.org/changeset/base/338979

Log:
  Fix NULL pointer dereference in freebsd4_getfsstat. [EN-18:10.syscall]
  
  Reported by:	Thomas Barabosch, Fraunhofer FKIE
  Approved by:	so
  Security:	FreeBSD-EN-18:10.syscall
  Security:	CVE-2018-17154

Modified:
  releng/11.1/sys/kern/vfs_syscalls.c
  releng/11.2/sys/kern/vfs_syscalls.c

Modified: releng/11.1/sys/kern/vfs_syscalls.c
==============================================================================
--- releng/11.1/sys/kern/vfs_syscalls.c	Thu Sep 27 18:29:55 2018	(r338978)
+++ releng/11.1/sys/kern/vfs_syscalls.c	Thu Sep 27 18:32:14 2018	(r338979)
@@ -641,6 +641,8 @@ freebsd4_getfsstat(td, uap)
 	size = count * sizeof(struct statfs);
 	error = kern_getfsstat(td, &buf, size, &count, UIO_SYSSPACE,
 	    uap->mode);
+	if (buf == NULL)
+		return (EINVAL);
 	td->td_retval[0] = count;
 	if (size != 0) {
 		sp = buf;

Modified: releng/11.2/sys/kern/vfs_syscalls.c
==============================================================================
--- releng/11.2/sys/kern/vfs_syscalls.c	Thu Sep 27 18:29:55 2018	(r338978)
+++ releng/11.2/sys/kern/vfs_syscalls.c	Thu Sep 27 18:32:14 2018	(r338979)
@@ -600,6 +600,8 @@ freebsd4_getfsstat(struct thread *td, struct freebsd4_
 	size = count * sizeof(struct statfs);
 	error = kern_getfsstat(td, &buf, size, &count, UIO_SYSSPACE,
 	    uap->mode);
+	if (buf == NULL)
+		return (EINVAL);
 	td->td_retval[0] = count;
 	if (size != 0) {
 		sp = buf;