kern/125849: nfs_decode_args() reads invalid memory when called from userspace

[Nathan Whitehorn]

>Number:         125849
>Category:       kern
>Synopsis:       nfs_decode_args() reads invalid memory when called from userspace
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Tue Jul 22 03:40:03 UTC 2008
>Closed-Date:
>Last-Modified:
>Originator:     Nathan Whitehorn
>Release:        8.0-CURRENT
>Organization:
University of Wisconsin
>Environment:
FreeBSD ceto.tachypleus.net 8.0-CURRENT FreeBSD 8.0-CURRENT #729: Mon Jul 21 17:58:55 CDT 2008     root at trantor.tachypleus.net:/usr/obj/powerpc/usr/src/sys/CETO  powerpc
>Description:
Starting with revision 1.206 of nfs_vfsops.c, the function nfs_decode_args() terminates by doing 

strlcpy(nmp->nm_hostname, argp->hostname, sizeof(nmp->nm_hostname)
p = strchr(nmp->nm_hostname, ':');
if (p)
  	*p = '\0';

When called from userspace by updating a mount (as happens when an NFS root is remounted read-only), argp->hostname is a pointer in the address space of the calling userspace code. Since the kernel doesn't do copyin(), it copies potentially invalid memory. On 64-bit PowerPC systems, this causes a kernel panic. since low memory is not generally mapped into kernel space.
>How-To-Repeat:

>Fix:
I'm not sure what this code is for -- the commit message is about other code -- and removing it seems harmless.

>Release-Note:
>Audit-Trail:
>Unformatted: