[src/netbsd-2-0]: src/sys/kern Pull up following revision(s) (requested by dr...

[riz <riz%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/1da6fb854cc2
branches:  netbsd-2-0
changeset: 564954:1da6fb854cc2
user:      riz <riz%NetBSD.org@localhost>
date:      Fri Mar 24 21:39:04 2006 +0000

description:
Pull up following revision(s) (requested by drochner in ticket #10381):
        sys/kern/kern_sysctl.c: revision 1.191
Check the "oldlen" argument to sysctl(2) before passing it
to vslock(9). This prevents a local DOS.
(The checks against system and user limits for wired
memory should be centralized in UVM; for now prefer a less
invasive fix which can be pulled pulled up into releases.)

diffstat:

 sys/kern/kern_sysctl.c |  12 ++++++++++--
 1 files changed, 10 insertions(+), 2 deletions(-)

diffs (33 lines):

diff -r ea50f69bc68a -r 1da6fb854cc2 sys/kern/kern_sysctl.c
--- a/sys/kern/kern_sysctl.c    Fri Mar 24 19:15:48 2006 +0000
+++ b/sys/kern/kern_sysctl.c    Fri Mar 24 21:39:04 2006 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: kern_sysctl.c,v 1.169.2.6 2004/05/14 06:18:39 jdc Exp $        */
+/*     $NetBSD: kern_sysctl.c,v 1.169.2.7 2006/03/24 21:39:04 riz Exp $        */
 
 /*-
  * Copyright (c) 2003 The NetBSD Foundation, Inc.
@@ -75,7 +75,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: kern_sysctl.c,v 1.169.2.6 2004/05/14 06:18:39 jdc Exp $");
+__KERNEL_RCSID(0, "$NetBSD: kern_sysctl.c,v 1.169.2.7 2006/03/24 21:39:04 riz Exp $");
 
 #include "opt_defcorename.h"
 #include "opt_insecure.h"
@@ -349,6 +349,14 @@
                return (error);
 
        if (l != NULL && oldp != NULL && savelen) {
+               /*
+                * be lazy - memory is locked for short time only, so
+                * just do a basic check against system limit
+                */
+               if (uvmexp.wired + atop(savelen) > uvmexp.wiredmax) {
+                       lockmgr(&sysctl_treelock, LK_RELEASE, NULL);
+                       return (ENOMEM);
+               }
                error = uvm_vslock(l->l_proc, oldp, savelen, VM_PROT_WRITE);
                if (error) {
                        (void) lockmgr(&sysctl_treelock, LK_RELEASE, NULL);