[src/netbsd-6]: src/sys/kern Pull up following revision(s) (requested by maxv...

[msaitoh <msaitoh%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/2c03d95be8be
branches:  netbsd-6
changeset: 776665:2c03d95be8be
user:      msaitoh <msaitoh%NetBSD.org@localhost>
date:      Mon Jul 14 06:32:30 2014 +0000

description:
Pull up following revision(s) (requested by maxv in ticket #1098):
        sys/kern/sys_module.c: revision 1.15
Fix a user-controlled memory allocation. kmem_alloc(0) will panic the system.
ok christos@

diffstat:

 sys/kern/sys_module.c |  14 ++++++++++++--
 1 files changed, 12 insertions(+), 2 deletions(-)

diffs (43 lines):

diff -r 643612fbec7e -r 2c03d95be8be sys/kern/sys_module.c
--- a/sys/kern/sys_module.c     Mon Jul 14 06:21:22 2014 +0000
+++ b/sys/kern/sys_module.c     Mon Jul 14 06:32:30 2014 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: sys_module.c,v 1.13 2011/07/08 09:32:45 mrg Exp $      */
+/*     $NetBSD: sys_module.c,v 1.13.8.1 2014/07/14 06:32:30 msaitoh Exp $      */
 
 /*-
  * Copyright (c) 2008 The NetBSD Foundation, Inc.
@@ -31,7 +31,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: sys_module.c,v 1.13 2011/07/08 09:32:45 mrg Exp $");
+__KERNEL_RCSID(0, "$NetBSD: sys_module.c,v 1.13.8.1 2014/07/14 06:32:30 msaitoh Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -43,6 +43,11 @@
 #include <sys/syscall.h>
 #include <sys/syscallargs.h>
 
+/*
+ * Arbitrary limit to avoid DoS for excessive memory allocation.
+ */
+#define MAXPROPSLEN    4096
+
 static int
 handle_modctl_load(modctl_load_t *ml)
 {
@@ -64,7 +69,12 @@
                goto out2;
 
        if (ml->ml_props != NULL) {
+               if (ml->ml_propslen > MAXPROPSLEN) {
+                       error = ENOMEM;
+                       goto out2;
+               }
                propslen = ml->ml_propslen + 1;
+
                props = (char *)kmem_alloc(propslen, KM_SLEEP);
                if (props == NULL) {
                        error = ENOMEM;