kern/vfs_mount.c vfs_donmount() checks of MFSNAMELEN

[Sean Bruno]

On Mon, 2013-09-23 at 11:02 -0700, Kirk McKusick wrote:
> > So, I'm confused by this check:
> > 
> >         if (fstypelen >= MFSNAMELEN - 1 || fspathlen >= MNAMELEN -
> 1) {
> >                 error = ENAMETOOLONG;
> >                 goto bail;
> >         }
> > 
> > MFSNAMELEN is 16, why do we check against >= MFSNAMELEN - 1?  Why
> dont
> > we check against (> MFSNAMELEN - 1) or (>= MFSNAMELEN)?  Is a 14
> > character fstypelen with a "\0" at the end considered too long?
> > 
> > Sean
> > 
> > p.s. e.g. mount -t fuse.glusterfs ...
> 
> I agree with you. It should either be (> MFSNAMELEN - 1) or (>=
> MFSNAMELEN).
> 
>         Kirk McKusick 

Not sure if we should adjust MNAMELEN or not too while we're at it, I
need to do a bit more of a code audit before thunking that one.

Propsed patch to set fstyplen check:
Index: sys/kern/vfs_mount.c
===================================================================
--- sys/kern/vfs_mount.c	(revision 255831)
+++ sys/kern/vfs_mount.c	(working copy)
@@ -656,7 +656,7 @@
 	 * variables will fit in our mp buffers, including the
 	 * terminating NUL.
 	 */
-	if (fstypelen >= MFSNAMELEN - 1 || fspathlen >= MNAMELEN - 1) {
+	if (fstypelen >= MFSNAMELEN || fspathlen >= MNAMELEN - 1) {
 		error = ENAMETOOLONG;
 		goto bail;
 	}



-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 488 bytes
Desc: This is a digitally signed message part
URL: <http://lists.freebsd.org/pipermail/freebsd-fs/attachments/20130923/76184dce/attachment.sig>