| From: | "fanch \(via DragonFly issue tracker\)" <sinknull@xxxxxxxxxxxxxxxxxxxxx> |
| Date: | Sat, 23 Oct 2010 18:14:08 +0000 |
New submission from fanch <fanch@kekpar.net>: In devfs_rules.c, struct "devfs_rule_ioctl" member "rule_type" is tested as an integer, but is a bitmask. So when both DEVFS_RULE_NAME and DEVFS_RULE_JAIL are set, the member "name" in newly created devfs_rule is set to NULL. Later, devfs_rule_checkname() is called, and the kernel will panic in devfs_resolve_name_path(). See diff for a partial correction (len==0 and invalid name or linkname pointers need to be handled elsewhere). By the way, /dev/rc.d/devfs seems to be called too early in the boot process: it does nothing. But calling it later (manually) works. ---------- files: devfs_rules.c.diff messages: 9161 nosy: fanch priority: bug status: unread title: Panic when mounting a jailed devfs with jail devfs.conf entries _____________________________________________________ DragonFly issue tracker <bugs@lists.dragonflybsd.org> <http://bugs.dragonflybsd.org/issue1885> _____________________________________________________
Attachment:
devfs_rules.c.diff
Description: Binary data