svn commit: r209711 - releng/8.1/sys/kern

[Michael Tuexen]

Author: tuexen
Date: Mon Jul  5 18:45:59 2010
New Revision: 209711
URL: http://svn.freebsd.org/changeset/base/209711

Log:
  MFC r209624
   * Do not dereference a NULL pointer when calling an SCTP send syscall
     not providing a destination address and using ktrace.
   * Do not copy out kernel memory when providing sinfo for sctp_recvmsg().
   Both bugs where reported by Valentin Nechayev.
   The first bug results in a kernel panic.
  Approved by: re@

Modified:
  releng/8.1/sys/kern/uipc_syscalls.c
Directory Properties:
  releng/8.1/sys/   (props changed)
  releng/8.1/sys/amd64/include/xen/   (props changed)
  releng/8.1/sys/cddl/contrib/opensolaris/   (props changed)
  releng/8.1/sys/contrib/dev/acpica/   (props changed)
  releng/8.1/sys/contrib/pf/   (props changed)
  releng/8.1/sys/dev/ixgbe/   (props changed)
  releng/8.1/sys/dev/xen/xenpci/   (props changed)
  releng/8.1/sys/geom/sched/   (props changed)

Modified: releng/8.1/sys/kern/uipc_syscalls.c
==============================================================================
--- releng/8.1/sys/kern/uipc_syscalls.c	Mon Jul  5 16:23:55 2010	(r209710)
+++ releng/8.1/sys/kern/uipc_syscalls.c	Mon Jul  5 18:45:59 2010	(r209711)
@@ -2413,7 +2413,7 @@ sctp_generic_sendmsg (td, uap)
 	if (error)
 		goto sctp_bad;
 #ifdef KTRACE
-	if (KTRPOINT(td, KTR_STRUCT))
+	if (to && (KTRPOINT(td, KTR_STRUCT)))
 		ktrsockaddr(to);
 #endif
 
@@ -2527,7 +2527,7 @@ sctp_generic_sendmsg_iov(td, uap)
 	if (error)
 		goto sctp_bad1;
 #ifdef KTRACE
-	if (KTRPOINT(td, KTR_STRUCT))
+	if (to && (KTRPOINT(td, KTR_STRUCT)))
 		ktrsockaddr(to);
 #endif
 
@@ -2681,6 +2681,7 @@ sctp_generic_recvmsg(td, uap)
 	if (KTRPOINT(td, KTR_GENIO))
 		ktruio = cloneuio(&auio);
 #endif /* KTRACE */
+	memset(&sinfo, 0, sizeof(struct sctp_sndrcvinfo));
 	CURVNET_SET(so->so_vnet);
 	error = sctp_sorecvmsg(so, &auio, (struct mbuf **)NULL,
 		    fromsa, fromlen, &msg_flags,