svn commit: r351961 - head/sys/fs/fuse

[Alan Somers]

Author: asomers
Date: Fri Sep  6 19:40:11 2019
New Revision: 351961
URL: https://svnweb.freebsd.org/changeset/base/351961

Log:
  Coverity fixes in fusefs(5)
  
  CID 1404532 fixes a signed vs unsigned comparison error in fuse_vnop_bmap.
  It could potentially have resulted in VOP_BMAP reporting too many
  consecutive blocks.
  
  CID 1404364 is much worse. It was an array access by an untrusted,
  user-provided variable. It could potentially have resulted in a malicious
  file system crashing the kernel or worse.
  
  Reported by:	Coverity
  Reviewed by:	emaste
  MFC after:	3 days
  Sponsored by:	The FreeBSD Foundation
  Differential Revision:	https://reviews.freebsd.org/D21466

Modified:
  head/sys/fs/fuse/fuse_internal.c
  head/sys/fs/fuse/fuse_vnops.c

Modified: head/sys/fs/fuse/fuse_internal.c
==============================================================================
--- head/sys/fs/fuse/fuse_internal.c	Fri Sep  6 19:36:41 2019	(r351960)
+++ head/sys/fs/fuse/fuse_internal.c	Fri Sep  6 19:40:11 2019	(r351961)
@@ -390,6 +390,9 @@ fuse_internal_invalidate_entry(struct mount *mp, struc
 	if ((err = uiomove(&fnieo, sizeof(fnieo), uio)) != 0)
 		return (err);
 
+	if (fnieo.namelen > sizeof(name))
+		return (EINVAL);
+
 	if ((err = uiomove(name, fnieo.namelen, uio)) != 0)
 		return (err);
 	name[fnieo.namelen] = '\0';

Modified: head/sys/fs/fuse/fuse_vnops.c
==============================================================================
--- head/sys/fs/fuse/fuse_vnops.c	Fri Sep  6 19:36:41 2019	(r351960)
+++ head/sys/fs/fuse/fuse_vnops.c	Fri Sep  6 19:40:11 2019	(r351961)
@@ -504,7 +504,7 @@ fuse_vnop_bmap(struct vop_bmap_args *ap)
 	if (runp != NULL) {
 		error = fuse_vnode_size(vp, &filesize, td->td_ucred, td);
 		if (error == 0)
-			*runp = MIN(MAX(0, filesize / biosize - lbn - 1),
+			*runp = MIN(MAX(0, filesize / (off_t)biosize - lbn - 1),
 				    maxrun);
 		else
 			*runp = 0;