Re: [PATCH] netbsd32 swapctl, round 3

[Matt Thomas <matt%3am-software.com@localhost>]

On Feb 1, 2014, at 12:41 AM, Emmanuel Dreyfus <manu%netbsd.org@localhost> wrote:

> +     int count = SCARG(uap, misc);
> +     int i, error;
> +
> +     sep = kmem_alloc(sizeof(*sep) * count, KM_SLEEP);
> +     sep32 = kmem_alloc(sizeof(*sep32) * count, KM_SLEEP);

Before using count, one must limit it using:

                if ((size_t)count > (size_t)uvmexp.nswapdev)
                        misc = uvmexp.nswapdev;

or a user could exhaust all memory by supplying bogus counts.

You only need one sep32 and then copyout each entry:

        for (i = 0, error = 0; i < count && error == 0; i++) {
                struct netbsd32_swapent sep32;
                sep32.se_dev = sep[i].se_dev;
                sep32.se_flags = sep[i].se_flags;
                sep32.se_nblks = sep[i].se_nblks;
                sep32.se_inuse = sep[i].se_inuse;
                sep32.se_priority = sep[i].se_priority;
                size_t len = strlcpy(sep32.se_path, sep[i].se_path,
                        sizeof(sep32.se_path));

                error = copyout(&sep32, SCARG(uap, arg + i),
                    offsetof(sep32.sep_path) + len + 1);
        }