⬢ DragonFlyBSD Kernel Audit
DF-3075 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
--- a/sys/vfs/nfs/nfs_vfsops.c	2026-06-29 12:51:19.000000000 +0000
+++ b/sys/vfs/nfs/nfs_vfsops.c	2026-10-26 03:29:41.720762279 +0000
@@ -357,17 +357,25 @@
 	if (info.v3) {
 		sbp->f_bsize = NFS_FABLKSIZE;
 		tquad = fxdr_hyper(&sfp->sf_tbytes);
-		sbp->f_blocks = (long)(tquad / ((u_quad_t)NFS_FABLKSIZE));
+		sbp->f_blocks = (tquad > (u_quad_t)LONG_MAX) ?
+		    LONG_MAX : (long)(tquad / ((u_quad_t)NFS_FABLKSIZE));
 		tquad = fxdr_hyper(&sfp->sf_fbytes);
-		sbp->f_bfree = (long)(tquad / ((u_quad_t)NFS_FABLKSIZE));
+		sbp->f_bfree = (tquad > (u_quad_t)LONG_MAX) ?
+		    LONG_MAX : (long)(tquad / ((u_quad_t)NFS_FABLKSIZE));
 		tquad = fxdr_hyper(&sfp->sf_abytes);
-		sbp->f_bavail = (long)(tquad / ((u_quad_t)NFS_FABLKSIZE));
+		sbp->f_bavail = (tquad > (u_quad_t)LONG_MAX) ?
+		    LONG_MAX : (long)(tquad / ((u_quad_t)NFS_FABLKSIZE));
 		sbp->f_files = (fxdr_unsigned(int32_t,
 		    sfp->sf_tfiles.nfsuquad[1]) & 0x7fffffff);
 		sbp->f_ffree = (fxdr_unsigned(int32_t,
 		    sfp->sf_ffiles.nfsuquad[1]) & 0x7fffffff);
 	} else {
+		/* sanity clamp the v2 server-claimed block size */
 		sbp->f_bsize = fxdr_unsigned(int32_t, sfp->sf_bsize);
+		if (sbp->f_bsize < DEV_BSIZE)
+			sbp->f_bsize = NFS_FABLKSIZE;
+		else if (sbp->f_bsize > MAXBSIZE)
+			sbp->f_bsize = MAXBSIZE;
 		sbp->f_blocks = fxdr_unsigned(int32_t, sfp->sf_blocks);
 		sbp->f_bfree = fxdr_unsigned(int32_t, sfp->sf_bfree);
 		sbp->f_bavail = fxdr_unsigned(int32_t, sfp->sf_bavail);
@@ -441,17 +449,22 @@
 	sbp->f_owner = nmp->nm_cred->cr_ruid;
 
 	if (info.v3) {
+		u_quad_t qv;
+
 		sbp->f_bsize = NFS_FABLKSIZE;
 		sbp->f_frsize = NFS_FABLKSIZE;
-		sbp->f_blocks = (fxdr_hyper(&sfp->sf_tbytes) /
-				((u_quad_t)NFS_FABLKSIZE));
-		sbp->f_bfree = (fxdr_hyper(&sfp->sf_fbytes) /
-				((u_quad_t)NFS_FABLKSIZE));
-		sbp->f_bavail = (fxdr_hyper(&sfp->sf_abytes) /
-				((u_quad_t)NFS_FABLKSIZE));
-		sbp->f_files = fxdr_hyper(&sfp->sf_tfiles);
-		sbp->f_ffree = fxdr_hyper(&sfp->sf_ffiles);
-		sbp->f_favail = fxdr_hyper(&sfp->sf_afiles);
+		qv = fxdr_hyper(&sfp->sf_tbytes) / ((u_quad_t)NFS_FABLKSIZE);
+		sbp->f_blocks = (qv > (u_quad_t)LONG_MAX) ? LONG_MAX : qv;
+		qv = fxdr_hyper(&sfp->sf_fbytes) / ((u_quad_t)NFS_FABLKSIZE);
+		sbp->f_bfree = (qv > (u_quad_t)LONG_MAX) ? LONG_MAX : qv;
+		qv = fxdr_hyper(&sfp->sf_abytes) / ((u_quad_t)NFS_FABLKSIZE);
+		sbp->f_bavail = (qv > (u_quad_t)LONG_MAX) ? LONG_MAX : qv;
+		qv = fxdr_hyper(&sfp->sf_tfiles);
+		sbp->f_files = (qv > (u_quad_t)LONG_MAX) ? LONG_MAX : qv;
+		qv = fxdr_hyper(&sfp->sf_ffiles);
+		sbp->f_ffree = (qv > (u_quad_t)LONG_MAX) ? LONG_MAX : qv;
+		qv = fxdr_hyper(&sfp->sf_afiles);
+		sbp->f_favail = (qv > (u_quad_t)LONG_MAX) ? LONG_MAX : qv;
 	} else {
 		sbp->f_bsize = fxdr_unsigned(int32_t, sfp->sf_bsize);
 		sbp->f_blocks = fxdr_unsigned(int32_t, sfp->sf_blocks);