Author: glebius
Date: Thu Jan 26 11:59:48 2012
New Revision: 230583
URL: http://svn.freebsd.org/changeset/base/230583
Log:
Although aio_nbytes is size_t, later is is signed to
casted types: to ssize_t in filesystem code and to
int in buf code, thus supplying a negative argument
leads to kernel panic later. To fix that check user
supplied argument in the beginning of syscall.
Submitted by: Maxim Dounin <mdounin mdounin.ru>, maxim@
Modified:
head/sys/kern/vfs_aio.c
Modified: head/sys/kern/vfs_aio.c
==============================================================================
--- head/sys/kern/vfs_aio.c Thu Jan 26 11:15:12 2012 (r230582)
+++ head/sys/kern/vfs_aio.c Thu Jan 26 11:59:48 2012 (r230583)
@@ -1552,6 +1552,12 @@ aio_aqueue(struct thread *td, struct aio
return (error);
}
+ /* XXX: aio_nbytes is later casted to signed types. */
+ if ((int)aiocbe->uaiocb.aio_nbytes < 0) {
+ uma_zfree(aiocb_zone, aiocbe);
+ return (EINVAL);
+ }
+
if (aiocbe->uaiocb.aio_sigevent.sigev_notify != SIGEV_KEVENT &&
aiocbe->uaiocb.aio_sigevent.sigev_notify != SIGEV_SIGNAL &&
aiocbe->uaiocb.aio_sigevent.sigev_notify != SIGEV_THREAD_ID &&
_______________________________________________
svn-src-head@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
