ktrace: Handle negative array sizes in ktrstructarray
ClosedPublic
Actions

Authored by markj on May 26 2021, 6:14 PM.

Tags

None

Referenced Files

	Unknown Object (File)
	Mon, Dec 2, 9:13 PM

	Unknown Object (File)
	Nov 7 2024, 1:38 AM

	Unknown Object (File)
	Nov 7 2024, 1:25 AM

	Unknown Object (File)
	Nov 6 2024, 11:46 PM

	Unknown Object (File)
	Oct 5 2024, 12:25 PM

	Unknown Object (File)
	Sep 27 2024, 3:52 AM

	Unknown Object (File)
	Sep 27 2024, 3:52 AM

	Unknown Object (File)
	Sep 27 2024, 3:44 AM

View All 55 Files

Subscribers

imp

Details

Reviewers

kib

Commits

rGf88510077377: ktrace: Handle negative array sizes in ktrstructarray

Summary

ktrstructarray() may be used to create copies of kevent(2) change and
event arrays. It is called before parameter validation is done and so
should check for bogus array lengths before allocating a copy.

Reported by: syzkaller

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Not Applicable

Unit

Tests Not Applicable

Event Timeline

markj created this revision.May 26 2021, 6:14 PM

Herald added a subscriber: imp. · View Herald TranscriptMay 26 2021, 6:14 PM

markj requested review of this revision.May 26 2021, 6:14 PM

Harbormaster completed remote builds in B39474: Diff 89922.May 26 2021, 6:14 PM

markj added a child revision: D30480: kevent: Prohibit negative change and event list lengths.May 26 2021, 6:14 PM

kib accepted this revision.May 27 2021, 12:03 AM

This revision is now accepted and ready to land.May 27 2021, 12:03 AM

Closed by commit rGf88510077377: ktrace: Handle negative array sizes in ktrstructarray (authored by markj). · Explain WhyMay 27 2021, 7:54 PM

This revision was automatically updated to reflect the committed changes.

markj added a commit: rGf88510077377: ktrace: Handle negative array sizes in ktrstructarray.

Revision Contents
Changeset List

Path

Size

sys/

kern/

kern_ktrace.c

2 lines

Diff 90026

View Options

ktrace: Handle negative array sizes in ktrstructarrayClosedPublicActions