From d7e8cfd63debb87138d4aadbd80c0c36f452c2ee Mon Sep 17 00:00:00 2001 From: Konstantin Belousov Date: Fri, 15 Jul 2016 09:23:18 +0000 Subject: [PATCH] Do not allow creation of char or block special nodes with VNOVAL dev_t. As was reported on http://seclists.org/oss-sec/2016/q3/68, tmpfs code contains assertion that rdev != VNOVAL. On FreeBSD, there is no other consequences except triggering the assert. To be compatible with systems where device nodes have some significance, reject mknod(2) call with dev == VNOVAL at the syscall level. Sponsored by: The FreeBSD Foundation MFC after: 1 week --- sys/kern/vfs_syscalls.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sys/kern/vfs_syscalls.c b/sys/kern/vfs_syscalls.c index 836821186bca..68950e127e05 100644 --- a/sys/kern/vfs_syscalls.c +++ b/sys/kern/vfs_syscalls.c @@ -1167,6 +1167,8 @@ kern_mknodat(struct thread *td, int fd, char *path, enum uio_seg pathseg, case S_IFCHR: case S_IFBLK: error = priv_check(td, PRIV_VFS_MKNOD_DEV); + if (error == 0 && dev == VNOVAL) + error = EINVAL; break; case S_IFMT: error = priv_check(td, PRIV_VFS_MKNOD_BAD);