- Fix amd64 local privilege escalation. [08:07]

- Fix nmount(2) local privilege escalation. [08:08]
- Fix IPv6 remote kernel panics. [08:09]

Fix for [08:07] is merge of r181823.

Submitted by:	kib [08:07], csjp [08:08], bz [08:09]
Reviewed by:	peter [08:07], jhb [08:07]
Reviewed by:	jinmei [08:09], rwatson [08:09]
Approved by:	re (SA blanket)
Approved by:	so (simon)
Security:	FreeBSD-SA-08:07.amd64
Security:	FreeBSD-SA-08:08.nmount
Security:	FreeBSD-SA-08:09.icmp6

sys/kern/vfs_mount.c

@@ -1848,7 +1848,8 @@ vfs_filteropt(struct vfsoptlist *opts, const char **legal)
 		}
 		if (*t != NULL)
 			continue;
-		sprintf(errmsg, "mount option <%s> is unknown", p);
+		snprintf(errmsg, sizeof(errmsg),
+		    "mount option <%s> is unknown", p);
 		printf("%s\n", errmsg);
 		ret = EINVAL;
 	}

sys/netinet6/icmp6.c

@@ -1122,6 +1122,15 @@ icmp6_mtudisc_update(struct ip6ctlparam *ip6cp, int validated)
 	if (!validated)
 		return;
 
+	/*
+	 * In case the suggested mtu is less than IPV6_MMTU, we
+	 * only need to remember that it was for above mentioned
+	 * "alwaysfrag" case.
+	 * Try to be as close to the spec as possible.
+	 */
+	if (mtu < IPV6_MMTU)
+		mtu = IPV6_MMTU - 8;
+
 	bzero(&inc, sizeof(inc));
 	inc.inc_flags = 1; /* IPv6 */
 	inc.inc6_faddr = *dst;