svn commit: r338987 - stable/11/sys/kern

[Gordon Tetlow]

Author: gordon
Date: Thu Sep 27 18:54:41 2018
New Revision: 338987
URL: https://svnweb.freebsd.org/changeset/base/338987

Log:
  Check to ensure the buffer returned is not NULL.
  
  Direct commit to the branch as this behavior is only seeing in stable/11.
  
  Reported by:	Thomas Barabosch, Fraunhofer FKIE
  Reviewed by:	wes@
  Approved by:	so
  Security:	FreeBSD-EN-18:10.syscall
  Security:	CVE-2018-17154

Modified:
  stable/11/sys/kern/vfs_syscalls.c

Modified: stable/11/sys/kern/vfs_syscalls.c
==============================================================================
--- stable/11/sys/kern/vfs_syscalls.c	Thu Sep 27 18:50:10 2018	(r338986)
+++ stable/11/sys/kern/vfs_syscalls.c	Thu Sep 27 18:54:41 2018	(r338987)
@@ -601,6 +601,8 @@ freebsd4_getfsstat(struct thread *td, struct freebsd4_
 	size = count * sizeof(struct statfs);
 	error = kern_getfsstat(td, &buf, size, &count, UIO_SYSSPACE,
 	    uap->mode);
+	if (buf == NULL)
+		return (EINVAL);
 	td->td_retval[0] = count;
 	if (size != 0) {
 		sp = buf;