From owner-svn-src-head@freebsd.org Mon Jan 8 15:29:03 2018 Return-Path: Delivered-To: svn-src-head@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id BF242E7281C for ; Mon, 8 Jan 2018 15:29:03 +0000 (UTC) (envelope-from pfg@FreeBSD.org) Received: from sonic312-35.consmr.mail.ne1.yahoo.com (sonic312-35.consmr.mail.ne1.yahoo.com [66.163.191.216]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 91C4F80154 for ; Mon, 8 Jan 2018 15:29:02 +0000 (UTC) (envelope-from pfg@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1515425342; bh=qCWPCvfC/NeNLjWqtNypZ1SEfRSYmXmJgxGyeOsPIyE=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From:Subject; b=pglKajKfJIc2rtJHEh8OX+bvad730R5PZrMdsbArO5oxEsMz76cuJQEpQAWKA62PjhTRmCZLWF1Hm93ez7TIc+kpdh7ocmpzKc9G5gZZMBE6jgjr9NoJsSIWNQNZzk0J/bOQhP7dewYOq5Cseps68QwGF59Esh99M0J3chSNCoumb8BbuuBPgCccA3r4tE2dMu+G6YKxivU6RvHDqgdYxVtSkVC6lCw4rDObgGgLsGhHULpbWlDTZgOU54ARDh41mV7xv/aNeHwW7UL9dC38EEWjoEzXg8gX2wITvl5O2wALHdTWtOBFdrOMEM/leafNewz/6Hqpkq7oRlkCykeriw== X-YMail-OSG: fpEclCYVM1n7ws2ySi7L7Bhb7n4shomKURrrQznn_oOW8JEjSJUpAq_fzixQD2x w0u1lS3spC03zSwI6bHl1EDwuqVFaC0k3a9V.8Ybo0HDlcwhbX.tqSeDWPLoPXxZnRY8wL2awZgE Aq66IFfdDYubDicP6AjcOHyea3hj0On2U8JvDFCDOBcjzu6J.KgpJmDcCVGyuKnXSmJN..2szVpQ CmZtYnONDEJGtgTt9o3aGa6Zggrjop4PhTwiI7CdJ3UzieLomWfcKQhNtjJlge39Vta9Otl_oDRw jKPNCxYQme_7duPx02klzCj2P703RzWBPB8jouPjXQ57DNZuABAIsdxsFoP0O2r.x6sdk_wVOqpv m.3Z2WZ66LPdkBHz8F.uPqjRHJAzMzoiPPQ.XR0VTB4GGobk44nK17q0faUC0_7MO.YXgi3D.xGt lrOXISuUlHW1OxIBOmB2gzSG2rBj9wucvY_Gg5F0BZZilqqdc8V.IUQttuY_6QVltewMYuAXM Received: from sonic.gate.mail.ne1.yahoo.com by sonic312.consmr.mail.ne1.yahoo.com with HTTP; Mon, 8 Jan 2018 15:29:02 +0000 Received: from smtpgate103.mail.ne1.yahoo.com (EHLO [192.168.0.6]) ([216.155.193.162]) by smtp414.mail.ne1.yahoo.com (JAMES SMTP Server ) with ESMTPA ID f4ea58c48869a7f2ae5062e2c9ea97de; Mon, 08 Jan 2018 15:08:47 +0000 (UTC) Subject: Re: svn commit: r327684 - in head/sys/compat: cloudabi32 cloudabi64 To: Andrew Turner , Ed Schouten Cc: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org References: <201801072238.w07McjLP099234@repo.freebsd.org> <8D8CA434-2A87-44D9-AC27-5166802FBBC2@fubar.geek.nz> From: Pedro Giffuni Organization: FreeBSD Project Message-ID: <191085f4-3496-e063-474f-3193a3188275@FreeBSD.org> Date: Mon, 8 Jan 2018 10:08:47 -0500 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.5.2 MIME-Version: 1.0 In-Reply-To: <8D8CA434-2A87-44D9-AC27-5166802FBBC2@fubar.geek.nz> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Content-Language: en-US X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.25 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Jan 2018 15:29:03 -0000 Hi; On 08/01/2018 02:37, Andrew Turner wrote: >> On 7 Jan 2018, at 22:38, Ed Schouten wrote: >> >> Author: ed >> Date: Sun Jan 7 22:38:45 2018 >> New Revision: 327684 >> URL: https://svnweb.freebsd.org/changeset/base/327684 >> >> Log: >> Use mallocarray(9) in CloudABI kernel code where possible. >> >> Submitted by: pfg@ >> >> Modified: >> head/sys/compat/cloudabi32/cloudabi32_sock.c >> head/sys/compat/cloudabi64/cloudabi64_sock.c >> >> Modified: head/sys/compat/cloudabi32/cloudabi32_sock.c >> ============================================================================== >> --- head/sys/compat/cloudabi32/cloudabi32_sock.c Sun Jan 7 22:21:07 2018 (r327683) >> +++ head/sys/compat/cloudabi32/cloudabi32_sock.c Sun Jan 7 22:38:45 2018 (r327684) >> @@ -60,7 +60,7 @@ cloudabi32_sys_sock_recv(struct thread *td, >> /* Convert iovecs to native format. */ >> if (ri.ri_data_len > UIO_MAXIOV) >> return (EINVAL); >> - iov = malloc(ri.ri_data_len * sizeof(struct iovec), >> + iov = mallocarray(ri.ri_data_len, sizeof(struct iovec), >> M_SOCKET, M_WAITOK); > Won’t this lead to a NULL pointer dereference on overflow? mallocarray can return NULL even with M_WAITOK. I think you are right: for the M_WAITOK case we should do the check outside the malloc. Compilers and static checkers should be giving out a warning since mallocarray() has the __result_use_check attribute (is that working!?). In the case of malloc(9) we should remove the attribute since we can by using M_WAITOK. And yes, this patch should be reverted. Pedro.