Aren
/
NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Check the "oldlen" argument to sysctl(2) before passing it 

to vslock(9). This prevents a local DOS.
(The checks against system and user limits for wired
memory should be centralized in UVM; for now prefer a less
invasive fix which can be pulled pulled up into releases.)
This commit is contained in:
drochner 2006-03-15 16:12:07 +00:00
parent 23a74d17e2
commit 94c70b92a9
1 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
sys/kern/kern_sysctl.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: kern_sysctl.c,v 1.190 2006/03/05 00:32:43 yamt Exp $ */
/* $NetBSD: kern_sysctl.c,v 1.191 2006/03/15 16:12:07 drochner Exp $ */
/*-
* Copyright (c) 2003 The NetBSD Foundation, Inc.
@ -75,7 +75,7 @@
*/
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: kern_sysctl.c,v 1.190 2006/03/05 00:32:43 yamt Exp $");
__KERNEL_RCSID(0, "$NetBSD: kern_sysctl.c,v 1.191 2006/03/15 16:12:07 drochner Exp $");
#include "opt_defcorename.h"
#include "opt_insecure.h"
@ -349,6 +349,14 @@ sysctl_lock(struct lwp *l, void *oldp, size_t savelen)
return (error);
if (l != NULL && oldp != NULL && savelen) {
/*
* be lazy - memory is locked for short time only, so
* just do a basic check against system limit
*/
if (uvmexp.wired + atop(savelen) > uvmexp.wiredmax) {
lockmgr(&sysctl_treelock, LK_RELEASE, NULL);
return (ENOMEM);
}
error = uvm_vslock(l->l_proc, oldp, savelen, VM_PROT_WRITE);
if (error) {
(void) lockmgr(&sysctl_treelock, LK_RELEASE, NULL);