c4d9a19be3
transmission which could be tricked into rounding up to the nearest page size, leaking up to a page of kernel memory. [13:11] In IPv6 and NetATM, stop SIOCSIFADDR, SIOCSIFBRDADDR, SIOCSIFDSTADDR and SIOCSIFNETMASK at the socket layer rather than pass them on to the link layer without validation or credential checks. [SA-13:12] Prevent cross-mount hardlinks between different nullfs mounts of the same underlying filesystem. [SA-13:13] Security: CVE-2013-5666 Security: FreeBSD-SA-13:11.sendfile Security: CVE-2013-5691 Security: FreeBSD-SA-13:12.ifioctl Security: CVE-2013-5710 Security: FreeBSD-SA-13:13.nullfs Approved by: so
28 lines
704 B
Diff
28 lines
704 B
Diff
Index: sys/fs/nullfs/null_vnops.c
|
|
===================================================================
|
|
--- sys/fs/nullfs/null_vnops.c (revision 254941)
|
|
+++ sys/fs/nullfs/null_vnops.c (working copy)
|
|
@@ -858,6 +858,15 @@
|
|
return (error);
|
|
}
|
|
|
|
+static int
|
|
+null_link(struct vop_link_args *ap)
|
|
+{
|
|
+
|
|
+ if (ap->a_tdvp->v_mount != ap->a_vp->v_mount)
|
|
+ return (EXDEV);
|
|
+ return (null_bypass((struct vop_generic_args *)ap));
|
|
+}
|
|
+
|
|
/*
|
|
* Global vfs data structures
|
|
*/
|
|
@@ -871,6 +880,7 @@
|
|
.vop_getwritemount = null_getwritemount,
|
|
.vop_inactive = null_inactive,
|
|
.vop_islocked = vop_stdislocked,
|
|
+ .vop_link = null_link,
|
|
.vop_lock1 = null_lock,
|
|
.vop_lookup = null_lookup,
|
|
.vop_open = null_open,
|