[src/netbsd-6-0]: src/sys/compat/netbsd32 Pull up following revision(s) (requ...

[martin <martin%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/b52c5bd6efa1
branches:  netbsd-6-0
changeset: 775121:b52c5bd6efa1
user:      martin <martin%NetBSD.org@localhost>
date:      Thu Apr 21 15:25:52 2016 +0000

description:
Pull up following revision(s) (requested by christos in ticket #1378):
        sys/compat/netbsd32/netbsd32_socket.c: revision 1.42
Memory leak, triggerable from an unprivileged user.

diffstat:

 sys/compat/netbsd32/netbsd32_socket.c |  28 +++++++++++++++++++---------
 1 files changed, 19 insertions(+), 9 deletions(-)

diffs (74 lines):

diff -r 553aaafc5b8c -r b52c5bd6efa1 sys/compat/netbsd32/netbsd32_socket.c
--- a/sys/compat/netbsd32/netbsd32_socket.c     Sat Apr 16 21:00:16 2016 +0000
+++ b/sys/compat/netbsd32/netbsd32_socket.c     Thu Apr 21 15:25:52 2016 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: netbsd32_socket.c,v 1.39.2.2 2012/08/18 22:01:40 riz Exp $     */
+/*     $NetBSD: netbsd32_socket.c,v 1.39.2.2.4.1 2016/04/21 15:25:52 martin Exp $      */
 
 /*
  * Copyright (c) 1998, 2001 Matthew R. Green
@@ -27,7 +27,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: netbsd32_socket.c,v 1.39.2.2 2012/08/18 22:01:40 riz Exp $");
+__KERNEL_RCSID(0, "$NetBSD: netbsd32_socket.c,v 1.39.2.2.4.1 2016/04/21 15:25:52 martin Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -331,7 +331,7 @@
        } */
        struct msghdr msg;
        struct netbsd32_msghdr msg32;
-       struct iovec aiov[UIO_SMALLIOV], *iov;
+       struct iovec aiov[UIO_SMALLIOV], *iov = aiov;
        struct netbsd32_iovec *iov32;
        size_t iovsz;
        int error;
@@ -346,6 +346,7 @@
                error = copyin32_msg_control(l, &msg);
                if (error)
                        return (error);
+               /* From here on, msg.msg_control is allocated */
        } else {
                msg.msg_control = NULL;
                msg.msg_controllen = 0;
@@ -353,23 +354,32 @@
 
        iovsz = msg.msg_iovlen * sizeof(struct iovec);
        if ((u_int)msg.msg_iovlen > UIO_SMALLIOV) {
-               if ((u_int)msg.msg_iovlen > IOV_MAX)
-                       return (EMSGSIZE);
+               if ((u_int)msg.msg_iovlen > IOV_MAX) {
+                       error = EMSGSIZE;
+                       goto out;
+               }
                iov = kmem_alloc(iovsz, KM_SLEEP);
-       } else
-               iov = aiov;
+       }
 
        iov32 = NETBSD32PTR64(msg32.msg_iov);
        error = netbsd32_to_iovecin(iov32, iov, msg.msg_iovlen);
        if (error)
-               goto done;
+               goto out;
        msg.msg_iov = iov;
 
        error = do_sys_sendmsg(l, SCARG(uap, s), &msg, SCARG(uap, flags), retval);
-done:
+       /* msg.msg_control freed by do_sys_sendmsg() */
+
        if (iov != aiov)
                kmem_free(iov, iovsz);
        return (error);
+
+out:
+       if (iov != aiov)
+               kmem_free(iov, iovsz);
+       if (msg.msg_control)
+               m_free(msg.msg_control);
+       return error;
 }
 
 int