kern/158339: replay_alloc() could dereference a null pointer...

[Greg Becker]

>Number:         158339
>Category:       kern
>Synopsis:       replay_alloc() could dereference a null pointer...
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Jun 27 12:30:09 UTC 2011
>Closed-Date:
>Last-Modified:
>Originator:     Greg Becker
>Release:        8.2
>Organization:
CodeConcepts
>Environment:
FreeBSD dev4.i.cacheiq.com 8.2-STABLE FreeBSD 8.2-STABLE #5: Wed Jun 22 11:11:13 CDT 2011     gbecker at dev4.i.cacheiq.com:/usr/obj/usr/src/sys/DEV4  amd64


>Description:
relay_alloc() (in src/sys/rpc/replay.c) calls malloc() with the M_NOWAIT flag, then proceeds to assume the pointer returned by malloc() is not NULL.  This could cause a panic in a situation in which malloc() cannot satisfy the request.

>How-To-Repeat:

>Fix:
Check the return code from malloc().  See attached patch.

Patch attached with submission follows:

--- /usr/src/sys/rpc/replay.c	2011-06-27 06:47:01.000000000 -0500
+++ /home/gbecker/replay.c	2011-06-27 06:46:21.000000000 -0500
@@ -115,14 +115,12 @@
 
 	rc->rc_count++;
 	rce = malloc(sizeof(*rce), M_RPC, M_NOWAIT|M_ZERO);
-	if (rce) {
-		rce->rce_hash = h;
-		rce->rce_msg = *msg;
-		bcopy(addr, &rce->rce_addr, addr->sa_len);
+	rce->rce_hash = h;
+	rce->rce_msg = *msg;
+	bcopy(addr, &rce->rce_addr, addr->sa_len);
 
-		TAILQ_INSERT_HEAD(&rc->rc_cache[h], rce, rce_link);
-		TAILQ_INSERT_HEAD(&rc->rc_all, rce, rce_alllink);
-	}
+	TAILQ_INSERT_HEAD(&rc->rc_cache[h], rce, rce_link);
+	TAILQ_INSERT_HEAD(&rc->rc_all, rce, rce_alllink);
 
 	return (rce);
 }


>Release-Note:
>Audit-Trail:
>Unformatted: