kern/114506: nfs_readdirrpc doesn't use copyout to write out dirents

[Eric Youngblut]

>Number:         114506
>Category:       kern
>Synopsis:       nfs_readdirrpc doesn't use copyout to write out dirents
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Jul 11 18:30:04 GMT 2007
>Closed-Date:
>Last-Modified:
>Originator:     Eric Youngblut
>Release:        FreeBSD HEAD
>Organization:
Isilon Systems
>Environment:
>Description:
/*
 * Readdir rpc call.
 * Called from below the buffer cache by nfs_doio().
 */
int
nfs_readdirrpc(struct vnode *vp, struct uio *uiop, struct ucred *cred)
{
...
				dp = (struct dirent *)uiop->uio_iov->iov_base;
				dp->d_fileno = fileno;
				dp->d_snapid = 0;
				dp->d_namlen = len;
				dp->d_reclen = tlen + DIRHDSIZ;
				dp->d_type = DT_UNKNOWN;

This needs to be a call to uiomove() which will do a copyout() into the user-space memory.

>How-To-Repeat:

>Fix:


>Release-Note:
>Audit-Trail:
>Unformatted: