mirror of
https://github.com/opnsense/src.git
synced 2026-03-24 19:53:08 -04:00
de38397ecf
code that says this:
nfsm_request(vp, NFSPROC_FSSTAT, p, cred);
if (v3)
nfsm_postop_attr(vp, retattr);
if (!error)
nfsm_dissect(sfp, struct nfs_statfs *, NFSX_STATFS(v3));
The problem here is that if error != 0, nfsm_dissect() will not be
called, which leaves sfp == NULL. But nfs_statfs() does not bail out
at this point: it continues processing until it tries to dereference
sfp, which causes a panic. I was able to generate this crash under
the following conditions:
1) Set up a machine as an NFS server and NFS client, with amd running
(using NIS maps). /usr/local is exported, though any exported fs
can can be used to trigger the bug.
2) Log in as normal user, with home directory mounted from a SunOS 4.1.3
NFS server via amd (along with a few other NFS filesystems from same
machine).
3) Su to root and type the following:
# mount localhost:/usr/local /mnt
# df
To fix the panic, I changed the code to read:
if (!error) {
nfsm_dissect(sfp, struct nfs_statfs *, NFSX_STATFS(v3));
} else
goto nfsmout;
This is a bit kludgy in that nfsmout is a label defined by the nfsm_subs.h
macros, but these macros are themselves more than a little kludgy. This
stops the machine from crashing, but does not fix the overall bug: 'error'
somehow becomes 5 (EIO) when a statfs() is performed on the locally mounted
NFS filesystem. This seems to only happen the first time the filesystem
is accesed: on subsequent accesses, it seems to work fine again.
Now, I know there's no practical use in mounting a local filesystem
via NFS, but doing it shouldn't cause the system to melt down.
|
||
|---|---|---|
| .. | ||
| alpha | ||
| amd64 | ||
| compat/linux | ||
| compile | ||
| conf | ||
| ddb | ||
| dev | ||
| fs | ||
| geom | ||
| gnu | ||
| i386 | ||
| isa | ||
| isofs/cd9660 | ||
| kern | ||
| libkern | ||
| miscfs | ||
| modules | ||
| msdosfs | ||
| net | ||
| netatalk | ||
| netinet | ||
| netipx | ||
| netkey | ||
| netnatm | ||
| netns | ||
| nfs | ||
| nfsclient | ||
| nfsserver | ||
| pc98 | ||
| pccard | ||
| pci | ||
| powerpc/include | ||
| rpc | ||
| scsi | ||
| sys | ||
| tools | ||
| ufs | ||
| vm | ||
| Makefile | ||