Module Name: src Committed By: msaitoh Date: Mon Jul 14 09:10:18 UTC 2014
Modified Files: src/sys/kern [netbsd-5-1]: sys_module.c Log Message: Pull up following revision(s) (requested by maxv in ticket #1914): sys/kern/sys_module.c: revision 1.15 via patch Fix a user-controlled memory allocation. kmem_alloc(0) will panic the system. ok christos@ To generate a diff of this commit: cvs rdiff -u -r1.8.4.1 -r1.8.4.1.2.1 src/sys/kern/sys_module.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
Modified files: Index: src/sys/kern/sys_module.c diff -u src/sys/kern/sys_module.c:1.8.4.1 src/sys/kern/sys_module.c:1.8.4.1.2.1 --- src/sys/kern/sys_module.c:1.8.4.1 Sun May 3 13:07:39 2009 +++ src/sys/kern/sys_module.c Mon Jul 14 09:10:18 2014 @@ -1,4 +1,4 @@ -/* $NetBSD: sys_module.c,v 1.8.4.1 2009/05/03 13:07:39 bouyer Exp $ */ +/* $NetBSD: sys_module.c,v 1.8.4.1.2.1 2014/07/14 09:10:18 msaitoh Exp $ */ /*- * Copyright (c) 2008 The NetBSD Foundation, Inc. @@ -31,7 +31,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: sys_module.c,v 1.8.4.1 2009/05/03 13:07:39 bouyer Exp $"); +__KERNEL_RCSID(0, "$NetBSD: sys_module.c,v 1.8.4.1.2.1 2014/07/14 09:10:18 msaitoh Exp $"); #include <sys/param.h> #include <sys/systm.h> @@ -43,6 +43,11 @@ __KERNEL_RCSID(0, "$NetBSD: sys_module.c #include <sys/syscall.h> #include <sys/syscallargs.h> +/* + * Arbitrary limit to avoid DoS for excessive memory allocation. + */ +#define MAXPROPSLEN 4096 + static int handle_modctl_load(modctl_load_t *ml) { @@ -63,6 +68,11 @@ handle_modctl_load(modctl_load_t *ml) if (error != 0) goto out2; + if (ml->ml_propslen > MAXPROPSLEN) { + error = ENOMEM; + goto out2; + } + propslen = ml->ml_propslen + 1; props = (char *)kmem_alloc(propslen, KM_SLEEP); if (props == NULL) {