ktrace: Handle negative array sizes in ktrstructarray
ClosedPublic
Actions

Authored by markj on May 26 2021, 6:14 PM.

Details

Reviewers

Commits

rGf88510077377: ktrace: Handle negative array sizes in ktrstructarray

Summary

ktrstructarray() may be used to create copies of kevent(2) change and
event arrays. It is called before parameter validation is done and so
should check for bogus array lengths before allocating a copy.

Reported by: syzkaller

Diff Detail

Repository

rS FreeBSD src repository - subversion

Lint

Lint Passed

Unit

No Test Coverage

Build Status

Buildable 39474
Build 36363: arc lint + arc unit

Event Timeline

markj created this revision.May 26 2021, 6:14 PM

Herald added a subscriber: imp. · View Herald TranscriptMay 26 2021, 6:14 PM

markj requested review of this revision.May 26 2021, 6:14 PM

Harbormaster completed remote builds in B39474: Diff 89922.May 26 2021, 6:14 PM

markj added a child revision: D30480: kevent: Prohibit negative change and event list lengths.May 26 2021, 6:14 PM

kib accepted this revision.May 27 2021, 12:03 AM

This revision is now accepted and ready to land.May 27 2021, 12:03 AM

Closed by commit rGf88510077377: ktrace: Handle negative array sizes in ktrstructarray (authored by markj). · Explain WhyMay 27 2021, 7:54 PM

This revision was automatically updated to reflect the committed changes.

markj added a commit: rGf88510077377: ktrace: Handle negative array sizes in ktrstructarray.

Revision Contents
Changeset List

Path

Size

sys/

kern/

kern_ktrace.c

2 lines

Diff 89922

View Options

ktrace: Handle negative array sizes in ktrstructarrayClosedPublicActions