svn commit: r344857 - head/sys/fs/fuse

[Konstantin Belousov]

On Wed, Mar 06, 2019 at 10:56:49PM +0000, Conrad Meyer wrote:
> Author: cem
> Date: Wed Mar  6 22:56:49 2019
> New Revision: 344857
> URL: https://svnweb.freebsd.org/changeset/base/344857
> 
> Log:
>   FUSE: Prevent trivial panic
>   
>   When open(2) was invoked against a FUSE filesystem with an unexpected flags
>   value (no O_RDONLY / O_RDWR / O_WRONLY), an assertion fired, causing panic.
Did you miss O_EXEC ?   O_RDONLY is defined as zero, and we interpret the
flags as having O_RDONLY if no other flags were passed.

VFS guarantees that one of the O_EXEC/FREAD/FWRITE flag is always
there.  If it does not, it is bug.  See the code at the start of
kern_openat().

>   
>   For now, prevent the panic by rejecting such VOP_OPENs with EINVAL.
>   
>   This is not considered the correct long term fix, but does prevent an
>   unprivileged denial-of-service.
>   
>   PR:		236329
>   Reported by:	asomers
>   Reviewed by:	asomers
>   Sponsored by:	Dell EMC Isilon
> 
> Modified:
>   head/sys/fs/fuse/fuse_vnops.c
> 
> Modified: head/sys/fs/fuse/fuse_vnops.c
> ==============================================================================
> --- head/sys/fs/fuse/fuse_vnops.c	Wed Mar  6 22:13:53 2019	(r344856)
> +++ head/sys/fs/fuse/fuse_vnops.c	Wed Mar  6 22:56:49 2019	(r344857)
> @@ -1174,6 +1174,9 @@ fuse_vnop_open(struct vop_open_args *ap)
>  	if (fuse_isdeadfs(vp)) {
>  		return ENXIO;
>  	}
> +	if ((mode & (FREAD | FWRITE)) == 0)
> +		return EINVAL;
> +
>  	fvdat = VTOFUD(vp);
>  
>  	if (vnode_isdir(vp)) {