[src/trunk]: src/sys/compat/freebsd I'm not sure reading from an unsanitized ...

[maxv <maxv%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/9b8c6eed0fed
branches:  trunk
changeset: 332847:9b8c6eed0fed
user:      maxv <maxv%NetBSD.org@localhost>
date:      Fri Oct 10 16:29:56 2014 +0000

description:
I'm not sure reading from an unsanitized userland pointer is a good idea.
Some users might be tempted to give 0x01, in which case the kernel will
crash.

diffstat:

 sys/compat/freebsd/freebsd_sysctl.c |  17 +++++++++++------
 1 files changed, 11 insertions(+), 6 deletions(-)

diffs (57 lines):

diff -r 142bb11a6dfe -r 9b8c6eed0fed sys/compat/freebsd/freebsd_sysctl.c
--- a/sys/compat/freebsd/freebsd_sysctl.c       Fri Oct 10 16:17:27 2014 +0000
+++ b/sys/compat/freebsd/freebsd_sysctl.c       Fri Oct 10 16:29:56 2014 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: freebsd_sysctl.c,v 1.16 2014/02/25 18:30:09 pooka Exp $        */
+/*     $NetBSD: freebsd_sysctl.c,v 1.17 2014/10/10 16:29:56 maxv Exp $ */
 
 /*-
  * Copyright (c) 2005 The NetBSD Foundation, Inc.
@@ -31,7 +31,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: freebsd_sysctl.c,v 1.16 2014/02/25 18:30:09 pooka Exp $");
+__KERNEL_RCSID(0, "$NetBSD: freebsd_sysctl.c,v 1.17 2014/10/10 16:29:56 maxv Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -90,7 +90,7 @@
        } */
        int error;
        int name[CTL_MAXNAME];
-       size_t newlen, *oldlenp;
+       size_t newlen, *oldlenp, oldlen;
        u_int namelen;
        void *new, *old;
 
@@ -141,9 +141,14 @@
 
                old = SCARG(uap, old);
                oldlenp = SCARG(uap, oldlenp);
-               if (old == NULL || oldlenp == NULL || *oldlenp < sizeof(int))
+               if (old == NULL || oldlenp == NULL)
                        return(EINVAL);
 
+               if ((error = copyin(oldlenp, &oldlen, sizeof(oldlen))))
+                       return (error);
+               if (oldlen < sizeof(int))
+                       return (EINVAL);
+
                if ((locnew =
                     (char *) malloc(newlen + 1, M_TEMP, M_WAITOK)) == NULL)
                        return(ENOMEM);
@@ -163,11 +168,11 @@
 
                oidlen *= sizeof(int);
                error = copyout(oid, SCARG(uap, old),
-                               MIN(oidlen, *SCARG(uap, oldlenp)));
+                               MIN(oidlen, oldlen));
                if (error)
                        return(error);
                ktrmibio(-1, UIO_READ, SCARG(uap, old),
-                   MIN(oidlen, *SCARG(uap, oldlenp)),  0);
+                   MIN(oidlen, oldlen),  0);
 
                error = copyout(&oidlen, SCARG(uap, oldlenp), sizeof(u_int));