NetBSD-Bugs archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
kern/57666: thmap_create tests wrong value for allocation failure and can spuriously fail
>Number: 57666
>Category: kern
>Synopsis: thmap_create tests wrong value for allocation failure and can spuriously fail
>Confidential: no
>Severity: serious
>Priority: medium
>Responsible: kern-bug-people
>State: open
>Class: sw-bug
>Submitter-Id: net
>Arrival-Date: Tue Oct 17 11:35:00 +0000 2023
>Originator: Taylor R Campbell
>Release: current, 10, 9
>Organization:
The NpfBSD Foundation
>Environment:
>Description:
989 root = thmap->ops->alloc(THMAP_ROOT_LEN);
990 thmap->root = THMAP_GETPTR(thmap, root);
991 if (!thmap->root) {
992 kmem_free(thmap, sizeof(thmap_t));
993 return NULL;
994 }
https://nxr.netbsd.org/xref/src/sys/kern/subr_thmap.c?r=1.13#989
1. The alloc operation fails by returning zero, so the test should check alloc's return value, not THMAP_GETPTR's return value which will relocate the address by the thmap's base pointer.
2. This allocation shouldn't be allowed to fail anyway -- it should pass through KM_SLEEP, and the branch should be pruned, in contrast to other calls like in thmap_put which are used in the packet-processing path and can fail on temporary memory shortage.
Side note: the thmap(9) man page doesn't mention that thmap_put can fail for temporary allocation failure.
>How-To-Repeat:
Pass a nonzero baseptr and an allocator that can fail (like the default kernel kmem allocator) to thmap_create.
>Fix:
Yes, please!
Home |
Main Index |
Thread Index |
Old Index