From owner-cvs-all@FreeBSD.ORG  Sat Jun 11 14:58:21 2005
Return-Path: <owner-cvs-all@FreeBSD.ORG>
X-Original-To: cvs-all@FreeBSD.org
Delivered-To: cvs-all@FreeBSD.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 9914816A41C;
	Sat, 11 Jun 2005 14:58:21 +0000 (GMT) (envelope-from pjd@FreeBSD.org)
Received: from repoman.freebsd.org (repoman.freebsd.org [216.136.204.115])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 7464343D1D;
	Sat, 11 Jun 2005 14:58:21 +0000 (GMT) (envelope-from pjd@FreeBSD.org)
Received: from repoman.freebsd.org (localhost [127.0.0.1])
	by repoman.freebsd.org (8.13.1/8.13.1) with ESMTP id j5BEwLes084858;
	Sat, 11 Jun 2005 14:58:21 GMT (envelope-from pjd@repoman.freebsd.org)
Received: (from pjd@localhost)
	by repoman.freebsd.org (8.13.1/8.13.1/Submit) id j5BEwL70084857;
	Sat, 11 Jun 2005 14:58:21 GMT (envelope-from pjd)
Message-Id: <200506111458.j5BEwL70084857@repoman.freebsd.org>
From: Pawel Jakub Dawidek <pjd@FreeBSD.org>
Date: Sat, 11 Jun 2005 14:58:20 +0000 (UTC)
To: src-committers@FreeBSD.org, cvs-src@FreeBSD.org, cvs-all@FreeBSD.org
X-FreeBSD-CVS-Branch: HEAD
Cc: 
Subject: cvs commit: src/sys/sys syscallsubr.h src/sys/kern vfs_syscalls.c
 src/sys/alpha/osf1 osf1_mount.c src/sys/compat/freebsd32
 freebsd32_misc.c
X-BeenThere: cvs-all@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: CVS commit messages for the entire tree <cvs-all.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/cvs-all>,
	<mailto:cvs-all-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/cvs-all>
List-Post: <mailto:cvs-all@freebsd.org>
List-Help: <mailto:cvs-all-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/cvs-all>,
	<mailto:cvs-all-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sat, 11 Jun 2005 14:58:21 -0000

pjd         2005-06-11 14:58:20 UTC

  FreeBSD src repository

  Modified files:
    sys/sys              syscallsubr.h 
    sys/kern             vfs_syscalls.c 
    sys/alpha/osf1       osf1_mount.c 
    sys/compat/freebsd32 freebsd32_misc.c 
  Log:
  Do not allocate memory based on not-checked argument from userland.
  It can be used to panic the kernel by giving too big value.
  Fix it by moving allocation and size verification into kern_getfsstat().
  This even simplifies kern_getfsstat() consumers, but destroys symmetry -
  memory is allocated inside kern_getfsstat(), but has to be freed by the
  caller.
  
  Found by:       FreeBSD Kernel Stress Test Suite: http://www.holm.cc/stress/
  Reported by:    Peter Holm <peter@holm.cc>
  
  Revision  Changes    Path
  1.25      +2 -6      src/sys/alpha/osf1/osf1_mount.c
  1.35      +2 -6      src/sys/compat/freebsd32/freebsd32_misc.c
  1.389     +28 -13    src/sys/kern/vfs_syscalls.c
  1.30      +1 -1      src/sys/sys/syscallsubr.h