git: e539e7a0954b - stable/13 - ktrace: Handle negative array sizes in ktrstructarray

Mark Johnston markj at FreeBSD.org
Thu Jun 3 13:29:05 UTC 2021


The branch stable/13 has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=e539e7a0954bc9fc0e308675b32d157917829cd4

commit e539e7a0954bc9fc0e308675b32d157917829cd4
Author:     Mark Johnston <markj at FreeBSD.org>
AuthorDate: 2021-05-27 19:49:12 +0000
Commit:     Mark Johnston <markj at FreeBSD.org>
CommitDate: 2021-06-03 13:28:42 +0000

    ktrace: Handle negative array sizes in ktrstructarray
    
    ktrstructarray() may be used to create copies of kevent(2) change and
    event arrays.  It is called before parameter validation is done and so
    should check for bogus array lengths before allocating a copy.
    
    Reported by:    syzkaller
    Reviewed by:    kib
    Sponsored by:   The FreeBSD Foundation
    
    (cherry picked from commit f88510077377157008f648b7036e1d1c9c83ea23)
---
 sys/kern/kern_ktrace.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sys/kern/kern_ktrace.c b/sys/kern/kern_ktrace.c
index 8728801acdf7..d0f7e0067064 100644
--- a/sys/kern/kern_ktrace.c
+++ b/sys/kern/kern_ktrace.c
@@ -803,6 +803,8 @@ ktrstructarray(const char *name, enum uio_seg seg, const void *data,
 
 	if (__predict_false(curthread->td_pflags & TDP_INKTRACE))
 		return;
+	if (num_items < 0)
+		return;
 
 	/* Trim array length to genio size. */
 	max_items = ktr_geniosize / struct_size;


More information about the dev-commits-src-all mailing list