Re: kern/57996 sysctl kern.ccd.info and kern.ccd.components abuse sysctl interface

[Paul Goyette <paul%whooppee.com@localhost>]

The following reply was made to PR kern/57996; it has been noted by GNATS.

From: Paul Goyette <paul%whooppee.com@localhost>
To: gnats-bugs%netbsd.org@localhost
Cc: 
Subject: Re: kern/57996 sysctl kern.ccd.info and kern.ccd.components abuse
 sysctl interface
Date: Tue, 5 Mar 2024 12:50:23 -0800 (PST)

 The following patch works around the problem, confirming that the
 diagnosis is correct.
 
 Index: ccd.c
 ===================================================================
 RCS file: /cvsroot/src/sys/dev/ccd.c,v
 retrieving revision 1.189
 diff -u -p -r1.189 ccd.c
 --- ccd.c	28 Mar 2022 12:48:35 -0000	1.189
 +++ ccd.c	5 Mar 2024 20:17:50 -0000
 @@ -1772,13 +1772,14 @@ ccd_info_sysctl(SYSCTLFN_ARGS)
  	struct sysctlnode node;
  	struct ccddiskinfo ccd;
  	struct ccd_softc *sc;
 -	int unit;
 +	int unit, error;
 
  	if (newp == NULL || newlen != sizeof(int))
  		return EINVAL;
 
 -	unit = *(const int *)newp;
 -	newp = NULL;
 +	error = sysctl_copyin(l, newp, &unit, sizeof unit);
 +	if (error)
 +		return error;
  	newlen = 0;
  	ccd.ccd_ndisks = ~0;
  	mutex_enter(&ccd_lock);
 @@ -1816,8 +1817,9 @@ ccd_components_sysctl(SYSCTLFN_ARGS)
  		return EINVAL;
 
   	size = 0;
 -	unit = *(const int *)newp;
 -	newp = NULL;
 +	error = sysctl_copyin(l, newp, &unit, sizeof unit);
 +	if (error)
 +		return error;
  	newlen = 0;
  	mutex_enter(&ccd_lock);
  	LIST_FOREACH(sc, &ccds, sc_link)
 
 
 +---------------------+--------------------------+----------------------+
 | Paul Goyette (.sig) | PGP Key fingerprint:     | E-mail addresses:    |
 | (Retired)           | 1B11 1849 721C 56C8 F63A | paul%whooppee.com@localhost    |
 | Software Developer  | 6E2E 05FD 15CE 9F2D 5102 | pgoyette%netbsd.org@localhost  |
 | & Network Engineer  |                          | pgoyette99%gmail.com@localhost |
 +---------------------+--------------------------+----------------------+