Date: Thu, 26 Jan 2012 11:59:48 +0000 (UTC) From: Gleb Smirnoff <glebius@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r230583 - head/sys/kern Message-ID: <201201261159.q0QBxma2086162@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: glebius Date: Thu Jan 26 11:59:48 2012 New Revision: 230583 URL: http://svn.freebsd.org/changeset/base/230583 Log: Although aio_nbytes is size_t, later is is signed to casted types: to ssize_t in filesystem code and to int in buf code, thus supplying a negative argument leads to kernel panic later. To fix that check user supplied argument in the beginning of syscall. Submitted by: Maxim Dounin <mdounin mdounin.ru>, maxim@ Modified: head/sys/kern/vfs_aio.c Modified: head/sys/kern/vfs_aio.c ============================================================================== --- head/sys/kern/vfs_aio.c Thu Jan 26 11:15:12 2012 (r230582) +++ head/sys/kern/vfs_aio.c Thu Jan 26 11:59:48 2012 (r230583) @@ -1552,6 +1552,12 @@ aio_aqueue(struct thread *td, struct aio return (error); } + /* XXX: aio_nbytes is later casted to signed types. */ + if ((int)aiocbe->uaiocb.aio_nbytes < 0) { + uma_zfree(aiocb_zone, aiocbe); + return (EINVAL); + } + if (aiocbe->uaiocb.aio_sigevent.sigev_notify != SIGEV_KEVENT && aiocbe->uaiocb.aio_sigevent.sigev_notify != SIGEV_SIGNAL && aiocbe->uaiocb.aio_sigevent.sigev_notify != SIGEV_THREAD_ID &&
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201201261159.q0QBxma2086162>