vfs_exports: Tighten bounds and assert consistency of numsecflavors

[freqlabs]

Summary

We know the value must be greater than 0 and less than MAXSECFLAVORS.

Reject values outside this range in the initial check in vfs_export and add KASSERTs
in the later consumers.

Also check that we are called with one of either MNT_DELEXPORT or MNT_EXPORTED set.

Sponsored by: iXsystems, Inc.

[freqlabs]

sys/kern/vfs_export.c

307–308

This is actually a problem for MNT_DELEXPORT, where we don't use ex_numsecflavors and it is 0.

[rmacklem]

After you have updated your patch, I'll look again.
Thanks for doing this, rick

sys/kern/vfs_export.c

120

It might be better to make this a check that returns an
error instead of a KASSERT(). Although this can only
be done by "root", I'm not sure panicing because a
userland daemon does something bogus is what I'd do.
(You can printf(), so that the bogus case gets logged.)

307–308

Yes, allowing 0 for the MNT_DELEXPORT case is correct.
I'd either just leave this code or add a check for MNT_DELEXPORT
and allow the 0 for that case, but not for MNT_EXPORTED.

[freqlabs]

sys/kern/vfs_export.c

120

There should be no way for these asserts to fail, due to the check in vfs_export. Likewise for the KASSERTs in vfs_stdcheckexp. We should be able to assert these invariants, and should an assertion fail, something really has gone terribly wrong.

307–308

I'll add a check that either MNT_DELEXPORT or MNT_EXPORTED is set, and when MNT_EXPORTED is set do the additional bounds check.

[rmacklem]

sys/kern/vfs_export.c

120

Yes, you are correct. I was thinking vfs_hang_addrlist() was being called from
other places than after the sanity checks.