kern/80775: sysctl_handle_string should have a timeout

[Hans Petter Selasky]

>Number:         80775
>Category:       kern
>Synopsis:       sysctl_handle_string should have a timeout
>Confidential:   no
>Severity:       critical
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun May 08 13:50:02 GMT 2005
>Closed-Date:
>Last-Modified:
>Originator:     HPS
>Release:        FreeBSD 6.0-CURRENT i386
>Organization:
>Environment:
System: FreeBSD 6.0-CURRENT FreeBSD 6.0-CURRENT #45: Mon Mar 21 15:40:17 CET 
2005 root@:/usr/obj/usr/src/sys/custom i386

>Description:

File: /sys/kern/kern_sysctl.c 

int
sysctl_handle_string(SYSCTL_HANDLER_ARGS)
{
        int error=0;
        char *tmparg;
        size_t outlen;

        /*
         * Attempt to get a coherent snapshot by copying to a
         * temporary kernel buffer.
         */
retry:
        outlen = strlen((char *)arg1)+1;
        tmparg = malloc(outlen, M_SYSCTLTMP, M_WAITOK);

        if (strlcpy(tmparg, (char *)arg1, outlen) >= outlen) {
                free(tmparg, M_SYSCTLTMP);
                goto retry;
        }

        error = SYSCTL_OUT(req, tmparg, outlen);
        free(tmparg, M_SYSCTLTMP);


When a device detaches strings can be left in freed memory, so 
"sysctl_handle_string" shouldn't try forever. Also the thread updating the 
string can sleep.

>How-To-Repeat:

>Fix:

Should have a timeout count and something like:

u_int8_t to = 255;

if(to--)
goto retry;
else return EINVAL;
>Release-Note:
>Audit-Trail:
>Unformatted: