kern/56962: Incorrect behavior of the devsw_attach function

[ivan.buravlev%hotmail.com@localhost]

>Number:         56962
>Category:       kern
>Synopsis:       Incorrect behavior of the devsw_attach function
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Aug 09 12:50:01 +0000 2022
>Originator:     Ivan Buravlev
>Release:        MAIN src branch since Mar 28 12:33:32 2022
>Organization:
Kaspersky Lab
>Environment:
source code
>Description:
In sys/kern/subr_devsw.c:197 incorrect if-condition.

193	/*
194	 * If we already found a conv, we're done.  Otherwise, find an
195	 * empty slot or extend the table.
196	 */
197	if (i == max_devsw_convs)
198		goto out;

Function execution should be interrupted if conv is found. But i is equal to max_devsw_convs if conv is not found. Additionally, at the goto point, the error variable remains uninitialized.

>How-To-Repeat:

>Fix:
193	/*
194	 * If we already found a conv, we're done.  Otherwise, find an
195	 * empty slot or extend the table.
196	 */
197	if (i < max_devsw_convs) {
198		error = 0;
199		goto out;
200	}