details: https://anonhg.NetBSD.org/src/rev/f02b20de5753
branches: trunk
changeset: 330473:f02b20de5753
user: maxv <maxv%NetBSD.org@localhost>
date: Thu Jul 10 19:12:07 2014 +0000
description:
Fix a user-controlled memory allocation. kmem_alloc(0) will panic the system.
ok christos@
diffstat:
sys/kern/sys_module.c | 14 ++++++++++++--
1 files changed, 12 insertions(+), 2 deletions(-)
diffs (43 lines):
diff -r 6adde26c30ca -r f02b20de5753 sys/kern/sys_module.c
--- a/sys/kern/sys_module.c Thu Jul 10 15:32:09 2014 +0000
+++ b/sys/kern/sys_module.c Thu Jul 10 19:12:07 2014 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: sys_module.c,v 1.14 2012/08/07 01:19:05 jnemeth Exp $ */
+/* $NetBSD: sys_module.c,v 1.15 2014/07/10 19:12:07 maxv Exp $ */
/*-
* Copyright (c) 2008 The NetBSD Foundation, Inc.
@@ -31,7 +31,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: sys_module.c,v 1.14 2012/08/07 01:19:05 jnemeth Exp $");
+__KERNEL_RCSID(0, "$NetBSD: sys_module.c,v 1.15 2014/07/10 19:12:07 maxv Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@@ -46,6 +46,11 @@
#include <opt_modular.h>
+/*
+ * Arbitrary limit to avoid DoS for excessive memory allocation.
+ */
+#define MAXPROPSLEN 4096
+
static int
handle_modctl_load(modctl_load_t *ml)
{
@@ -67,7 +72,12 @@
goto out2;
if (ml->ml_props != NULL) {
+ if (ml->ml_propslen > MAXPROPSLEN) {
+ error = ENOMEM;
+ goto out2;
+ }
propslen = ml->ml_propslen + 1;
+
props = (char *)kmem_alloc(propslen, KM_SLEEP);
if (props == NULL) {
error = ENOMEM;