NetBSD-Bugs archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

kern/57666: thmap_create tests wrong value for allocation failure and can spuriously fail



>Number:         57666
>Category:       kern
>Synopsis:       thmap_create tests wrong value for allocation failure and can spuriously fail
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Oct 17 11:35:00 +0000 2023
>Originator:     Taylor R Campbell
>Release:        current, 10, 9
>Organization:
The NpfBSD Foundation
>Environment:
>Description:
    989 		root = thmap->ops->alloc(THMAP_ROOT_LEN);
    990 		thmap->root = THMAP_GETPTR(thmap, root);
    991 		if (!thmap->root) {
    992 			kmem_free(thmap, sizeof(thmap_t));
    993 			return NULL;
    994 		}
https://nxr.netbsd.org/xref/src/sys/kern/subr_thmap.c?r=1.13#989

1. The alloc operation fails by returning zero, so the test should check alloc's return value, not THMAP_GETPTR's return value which will relocate the address by the thmap's base pointer.

2. This allocation shouldn't be allowed to fail anyway -- it should pass through KM_SLEEP, and the branch should be pruned, in contrast to other calls like in thmap_put which are used in the packet-processing path and can fail on temporary memory shortage.

Side note: the thmap(9) man page doesn't mention that thmap_put can fail for temporary allocation failure.
>How-To-Repeat:
Pass a nonzero baseptr and an allocator that can fail (like the default kernel kmem allocator) to thmap_create.
>Fix:
Yes, please!



Home | Main Index | Thread Index | Old Index