sbuf_uionew(): sbuf_new() takes int as length

[kib]

Summary

Noted by: markj

[markj]

sys/kern/subr_sbuf.c

272

This still permits userspace to trigger a large kernel allocation.

pfs_read() imposes a limit of 1MB, PFS_MAXBUFSIZ. I think this is probably a reasonable limit for writes as well?

[kib]

Also check against SBUF_MINSIZE

[kib]

sys/kern/subr_sbuf.c

272

Even 1M is arguably large kernel allocation.
Without drain, it is the only way around.

I do not want to add drain support and drain code.

[kib]

Limit pseudofs max write size to 1M

[markj]

sys/kern/subr_sbuf.c

269

I suspect it should be uio->uio_resid < SBUF_MINSIZE - 1, otherwise it is impossible to write to a 1-byte file.

272

And consumers have to opt in to using sbuf drain anyway.

[kib]

SBUF_MAXSIZE - 1

[pho]

D29752.87397.diff looks good to me. Tested with syscall fuzzing of:

# /* 174 is freebsd6 pwrite */
#define SYS_pwritev     290
#define SYS_pwrite      476
#define SYS_preadv      289