svn commit: r315519 - stable/11/sys/kern

[Edward Tomasz Napierala]

Author: trasz
Date: Sat Mar 18 23:55:50 2017
New Revision: 315519
URL: https://svnweb.freebsd.org/changeset/base/315519

Log:
  MFC r311284:
  
  Fix bug that would result in a kernel crash in some cases involving
  a symlink and an autofs mount request.  The crash was caused by namei()
  calling bcopy() with a negative length, caused by numeric underflow:
  in lookup(), in the relookup path, the ni_pathlen was decremented too
  many times.  The bug was introduced in r296715.
  
  Big thanks to Alex Deiter for his help with debugging this.

Modified:
  stable/11/sys/kern/vfs_lookup.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/sys/kern/vfs_lookup.c
==============================================================================
--- stable/11/sys/kern/vfs_lookup.c	Sat Mar 18 23:37:00 2017	(r315518)
+++ stable/11/sys/kern/vfs_lookup.c	Sat Mar 18 23:55:50 2017	(r315519)
@@ -622,11 +622,13 @@ needs_exclusive_leaf(struct mount *mp, i
 int
 lookup(struct nameidata *ndp)
 {
-	char *cp;		/* pointer into pathname argument */
+	char *cp;			/* pointer into pathname argument */
+	char *prev_ni_next;		/* saved ndp->ni_next */
 	struct vnode *dp = NULL;	/* the directory we are searching */
 	struct vnode *tdp;		/* saved dp */
 	struct mount *mp;		/* mount table entry */
 	struct prison *pr;
+	size_t prev_ni_pathlen;		/* saved ndp->ni_pathlen */
 	int docache;			/* == 0 do not cache last component */
 	int wantparent;			/* 1 => wantparent or lockparent flag */
 	int rdonly;			/* lookup read-only flag bit */
@@ -688,7 +690,11 @@ dirloop:
 	printf("{%s}: ", cnp->cn_nameptr);
 	*cp = c; }
 #endif
+	prev_ni_pathlen = ndp->ni_pathlen;
 	ndp->ni_pathlen -= cnp->cn_namelen;
+	KASSERT(ndp->ni_pathlen <= PATH_MAX,
+	    ("%s: ni_pathlen underflow to %zd\n", __func__, ndp->ni_pathlen));
+	prev_ni_next = ndp->ni_next;
 	ndp->ni_next = cp;
 
 	/*
@@ -1009,6 +1015,8 @@ nextname:
 	    ("lookup: invalid path state."));
 	if (relookup) {
 		relookup = 0;
+		ndp->ni_pathlen = prev_ni_pathlen;
+		ndp->ni_next = prev_ni_next;
 		if (ndp->ni_dvp != dp)
 			vput(ndp->ni_dvp);
 		else