- Use CMSG_DATA(), to correctly to get a descriptor, fixing

  a locking botch in portal_open();
- set f_namemax at mount time and use copy_statfs_info() in
  portal_statfs();

This diff is a slight tweak of the diff sent in PR5968 by
Frank Denis (j at pureftpd.org) Thanks!

2 files changed, 12 insertions, 9 deletions

diff --git a/sys/miscfs/portal/portal_vfsops.c b/sys/miscfs/portal/portal_vfsops.c
index 2af5983412d..01e05099815 100644
--- a/sys/miscfs/portal/portal_vfsops.c
+++ b/sys/miscfs/portal/portal_vfsops.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: portal_vfsops.c,v 1.22 2007/10/29 15:38:00 chl Exp $	*/
+/*	$OpenBSD: portal_vfsops.c,v 1.23 2008/11/02 11:37:32 thib Exp $	*/
 /*	$NetBSD: portal_vfsops.c,v 1.14 1996/02/09 22:40:41 christos Exp $	*/
 
 /*
@@ -57,6 +57,7 @@
 #include <sys/protosw.h>
 #include <sys/domain.h>
 #include <sys/un.h>
+#include <sys/dirent.h>
 #include <miscfs/portal/portal.h>
 
 #define portal_init ((int (*)(struct vfsconf *))nullop)
@@ -125,6 +126,8 @@ portal_mount(struct mount *mp, const char *path, void *data, struct nameidata *n
 	mp->mnt_data = fmp;
 	vfs_getnewfsid(mp);
 
+	mp->mnt_stat.f_namemax = MAXNAMLEN;
+
 	(void) copyinstr(path, mp->mnt_stat.f_mntonname, MNAMELEN - 1, &size);
 	bzero(mp->mnt_stat.f_mntonname + size, MNAMELEN - size);
 	(void) copyinstr(args.pa_config, mp->mnt_stat.f_mntfromname,
@@ -220,12 +223,8 @@ portal_statfs(struct mount *mp, struct statfs *sbp, struct proc *p)
 	sbp->f_bavail = 0;
 	sbp->f_files = 1;		/* Allow for "." */
 	sbp->f_ffree = 0;		/* See comments above */
-	if (sbp != &mp->mnt_stat) {
-		bcopy(&mp->mnt_stat.f_fsid, &sbp->f_fsid, sizeof(sbp->f_fsid));
-		bcopy(mp->mnt_stat.f_mntonname, sbp->f_mntonname, MNAMELEN);
-		bcopy(mp->mnt_stat.f_mntfromname, sbp->f_mntfromname, MNAMELEN);
-	}
-	strncpy(sbp->f_fstypename, mp->mnt_vfc->vfc_name, MFSNAMELEN);
+	copy_statfs_info(sbp, mp);
+
 	return (0);
 }
 
diff --git a/sys/miscfs/portal/portal_vnops.c b/sys/miscfs/portal/portal_vnops.c
index 86b536789ec..fede74bf576 100644
--- a/sys/miscfs/portal/portal_vnops.c
+++ b/sys/miscfs/portal/portal_vnops.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: portal_vnops.c,v 1.27 2008/05/08 17:45:45 thib Exp $	*/
+/*	$OpenBSD: portal_vnops.c,v 1.28 2008/11/02 11:37:32 thib Exp $	*/
 /*	$NetBSD: portal_vnops.c,v 1.17 1996/02/13 13:12:57 mycroft Exp $	*/
 
 /*
@@ -418,6 +418,10 @@ portal_open(void *v)
 	 * than a single mbuf in it.  What to do?
 	 */
 	cmsg = mtod(cm, struct cmsghdr *);
+	if (cmsg->cmsg_len < CMSG_LEN(0)) {
+		error = EMSGSIZE;
+		goto bad;
+	}
 	newfds = (cmsg->cmsg_len - sizeof(*cmsg)) / sizeof (int);
 	if (newfds == 0) {
 		error = ECONNREFUSED;
@@ -429,7 +433,7 @@ portal_open(void *v)
 	 * integer file descriptors.  The fds were allocated by the action
 	 * of receiving the control message.
 	 */
-	ip = (int *)(cmsg + 1);
+	ip = (int *)CMSG_DATA(cmsg);
 	fd = *ip++;
 	if (newfds > 1) {
 		/*