diff options
| author | mckusick <mckusick@FreeBSD.org> | 2016-01-27 21:27:05 +0000 |
|---|---|---|
| committer | mckusick <mckusick@FreeBSD.org> | 2016-01-27 21:27:05 +0000 |
| commit | 32cb8b928ab479168c225f3499c467fc1c2c443f (patch) | |
| tree | d22f67a7c76d31bd8a0cf76aca44675ab9a88dbd /contrib/llvm/tools/clang/lib/CodeGen/CodeGenAction.cpp | |
| parent | 0b10a802f877a41beb1b823c21a6a4b241ed8e28 (diff) | |
| download | FreeBSD-src-32cb8b928ab479168c225f3499c467fc1c2c443f.zip FreeBSD-src-32cb8b928ab479168c225f3499c467fc1c2c443f.tar.gz | |
This fixes a bug in UFS2 exported NFS volumes. An NFS client can
crash a server that has exported UFS2 by presenting a filehandle
with an inode number that references an uninitialized inode in a
cylinder group. The problem is that UFS2 only initializes blocks
of inodes as they are first allocated and ffs_fhtovp() does not
validate that the inode is in a range of inodes that have been
initialized. Attempting to read an uninitialized inode gets random
data from the disk. When the kernel tries to interpret it as an
inode, panics often arise.
Reported by: Christos Zoulas (from NetBSD)
Reviewed by: kib
Diffstat (limited to 'contrib/llvm/tools/clang/lib/CodeGen/CodeGenAction.cpp')
0 files changed, 0 insertions, 0 deletions
