Date: Fri, 24 Apr 2015 19:05:10 +0000 From: bugzilla-noreply@freebsd.org To: freebsd-bugs@FreeBSD.org Subject: [Bug 199673] sysctl(8) suffers a multiplication overflow when formatting vm.vmtotal Message-ID: <bug-199673-8@https.bugs.freebsd.org/bugzilla/>
next in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=199673 Bug ID: 199673 Summary: sysctl(8) suffers a multiplication overflow when formatting vm.vmtotal Product: Base System Version: 10.0-RELEASE Hardware: amd64 OS: Any Status: New Severity: Affects Only Me Priority: --- Component: bin Assignee: freebsd-bugs@FreeBSD.org Reporter: vmagerya@gmail.com Created attachment 155955 --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=155955&action=edit sysctl-overflow.diff Here's a part of 'sysctl vm.mvtotal' output on my 10.0/amd64 machine: % sysctl vm.vmtotal [...] Virtual Memory: (Total: 1654588K Active: 1536668K) [...] If on the other hand, when I try to retrieve the same data via sysctl(3), I get different total virtual memory: % cat >test.c <<'EOF' #include <stdio.h> #include <unistd.h> #include <sys/types.h> #include <sys/sysctl.h> #include <sys/vmmeter.h> int main() { struct vmtotal vt = {0}; size_t vtlen = sizeof(vt); if (sysctlbyname("vm.vmtotal", &vt, &vtlen, NULL, 0) != 0) return -1; ssize_t pagesize = getpagesize()/1024; printf("vm.vmtotal.t_vm = %zd pages (%zd kB)\n", (ssize_t)vt.t_vm, pagesize*vt.t_vm); return 0; } 'EOF' % c99 test.c && ./a.out vm.vmtotal.t_vm = 1074154446 pages (4296617784 kB) As you can see, the actual data coming out of sysctl(3) is 4296617784K, not 1654588K as sysctl(8) says. This is because sysctl(8) has a multiplication overflow in the 'S_vmtotal' function [1] when the number of pages ('t_vm') is multiplied by the page size ('pageKilo'). I'm attaching a (completely untested) patch to fix this problem; apply this patch to 'sbin/sysctl/sysctl.c'. [1] http://svnweb.freebsd.org/base/head/sbin/sysctl/sysctl.c?revision=278654&view=markup#l530 -- You are receiving this mail because: You are the assignee for the bug.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-199673-8>