[src/netbsd-7]: src/sys/compat/freebsd Pull up following revision(s) (request...

[martin <martin%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/ee993e1c2a66
branches:  netbsd-7
changeset: 798443:ee993e1c2a66
user:      martin <martin%NetBSD.org@localhost>
date:      Sat Oct 18 14:04:58 2014 +0000

description:
Pull up following revision(s) (requested by maxv in ticket #146):
        sys/compat/freebsd/freebsd_sysctl.c: revision 1.17
I'm not sure reading from an unsanitized userland pointer is a good idea.
Some users might be tempted to give 0x01, in which case the kernel will
crash.

diffstat:

 sys/compat/freebsd/freebsd_sysctl.c |  17 +++++++++++------
 1 files changed, 11 insertions(+), 6 deletions(-)

diffs (57 lines):

diff -r 3b7bd4c0141f -r ee993e1c2a66 sys/compat/freebsd/freebsd_sysctl.c
--- a/sys/compat/freebsd/freebsd_sysctl.c       Fri Oct 17 16:13:35 2014 +0000
+++ b/sys/compat/freebsd/freebsd_sysctl.c       Sat Oct 18 14:04:58 2014 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: freebsd_sysctl.c,v 1.16 2014/02/25 18:30:09 pooka Exp $        */
+/*     $NetBSD: freebsd_sysctl.c,v 1.16.4.1 2014/10/18 14:04:58 martin Exp $   */
 
 /*-
  * Copyright (c) 2005 The NetBSD Foundation, Inc.
@@ -31,7 +31,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: freebsd_sysctl.c,v 1.16 2014/02/25 18:30:09 pooka Exp $");
+__KERNEL_RCSID(0, "$NetBSD: freebsd_sysctl.c,v 1.16.4.1 2014/10/18 14:04:58 martin Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -90,7 +90,7 @@
        } */
        int error;
        int name[CTL_MAXNAME];
-       size_t newlen, *oldlenp;
+       size_t newlen, *oldlenp, oldlen;
        u_int namelen;
        void *new, *old;
 
@@ -141,9 +141,14 @@
 
                old = SCARG(uap, old);
                oldlenp = SCARG(uap, oldlenp);
-               if (old == NULL || oldlenp == NULL || *oldlenp < sizeof(int))
+               if (old == NULL || oldlenp == NULL)
                        return(EINVAL);
 
+               if ((error = copyin(oldlenp, &oldlen, sizeof(oldlen))))
+                       return (error);
+               if (oldlen < sizeof(int))
+                       return (EINVAL);
+
                if ((locnew =
                     (char *) malloc(newlen + 1, M_TEMP, M_WAITOK)) == NULL)
                        return(ENOMEM);
@@ -163,11 +168,11 @@
 
                oidlen *= sizeof(int);
                error = copyout(oid, SCARG(uap, old),
-                               MIN(oidlen, *SCARG(uap, oldlenp)));
+                               MIN(oidlen, oldlen));
                if (error)
                        return(error);
                ktrmibio(-1, UIO_READ, SCARG(uap, old),
-                   MIN(oidlen, *SCARG(uap, oldlenp)),  0);
+                   MIN(oidlen, oldlen),  0);
 
                error = copyout(&oidlen, SCARG(uap, oldlenp), sizeof(u_int));