From owner-freebsd-bugs  Wed Jun 19 15:40:23 2002
Delivered-To: freebsd-bugs@hub.freebsd.org
Received: from freefall.freebsd.org (freefall.FreeBSD.org [216.136.204.21])
	by hub.freebsd.org (Postfix) with ESMTP id 462C237B411
	for <freebsd-bugs@hub.freebsd.org>; Wed, 19 Jun 2002 15:40:04 -0700 (PDT)
Received: (from gnats@localhost)
	by freefall.freebsd.org (8.11.6/8.11.6) id g5JMe4P17368;
	Wed, 19 Jun 2002 15:40:04 -0700 (PDT)
	(envelope-from gnats)
Received: from nwww.freebsd.org (www.FreeBSD.org [216.136.204.117])
	by hub.freebsd.org (Postfix) with ESMTP id 71D7537B401
	for <freebsd-gnats-submit@FreeBSD.org>; Wed, 19 Jun 2002 15:38:19 -0700 (PDT)
Received: from www.freebsd.org (localhost [127.0.0.1])
	by nwww.freebsd.org (8.12.2/8.12.2) with ESMTP id g5JMcJhG036359
	for <freebsd-gnats-submit@FreeBSD.org>; Wed, 19 Jun 2002 15:38:19 -0700 (PDT)
	(envelope-from nobody@www.freebsd.org)
Received: (from nobody@localhost)
	by www.freebsd.org (8.12.2/8.12.2/Submit) id g5JMcJM4036357;
	Wed, 19 Jun 2002 15:38:19 -0700 (PDT)
Message-Id: <200206192238.g5JMcJM4036357@www.freebsd.org>
Date: Wed, 19 Jun 2002 15:38:19 -0700 (PDT)
From: James Gritton <gritton@iserver.com>
To: freebsd-gnats-submit@FreeBSD.org
X-Send-Pr-Version: www-1.0
Subject: kern/39547: SVR4 calls chgproccnt with the wrong argument
Sender: owner-freebsd-bugs@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-bugs.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-bugs>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-bugs>
X-Loop: FreeBSD.org


>Number:         39547
>Category:       kern
>Synopsis:       SVR4 calls chgproccnt with the wrong argument
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Jun 19 15:40:03 PDT 2002
>Closed-Date:
>Last-Modified:
>Originator:     James Gritton
>Release:        4.6
>Organization:
Verio Web Hosting
>Environment:
FreeBSD  4.6-RELEASE FreeBSD 4.6-RELEASE #0: Tue Jun 11 06:14:12 GMT 2002     murray@builder.freebsdmall.com:/usr/src/sys/compile/GENERIC  i386
>Description:
The SVR4 emulation function svr4_sys_waitsys in sys/svr4/svr4_misc.c calls chgproccnt(), passing it a UID (q->p_cred->p_ruid) instead of a pointer to struct uidinfo, as the call is expecting.  Chgproccnt wants to dereference this pointer.
>How-To-Repeat:
I didn't actually do anything to run the code, though it would seem pretty simple to kill the system with the proper UID.
>Fix:
Pass q->p_cred->p_uidinfo instead of q->p_cred->p_ruid.
>Release-Note:
>Audit-Trail:
>Unformatted:

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message