kern/80775: sysctl_handle_string should have a timeout

Hans Petter Selasky hselasky at
Sun May 8 06:50:04 PDT 2005

>Number:         80775
>Category:       kern
>Synopsis:       sysctl_handle_string should have a timeout
>Confidential:   no
>Severity:       critical
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun May 08 13:50:02 GMT 2005
>Originator:     HPS
>Release:        FreeBSD 6.0-CURRENT i386
System: FreeBSD 6.0-CURRENT FreeBSD 6.0-CURRENT #45: Mon Mar 21 15:40:17 CET 
2005 root@:/usr/obj/usr/src/sys/custom i386


File: /sys/kern/kern_sysctl.c 

        int error=0;
        char *tmparg;
        size_t outlen;

         * Attempt to get a coherent snapshot by copying to a
         * temporary kernel buffer.
        outlen = strlen((char *)arg1)+1;
        tmparg = malloc(outlen, M_SYSCTLTMP, M_WAITOK);

        if (strlcpy(tmparg, (char *)arg1, outlen) >= outlen) {
                free(tmparg, M_SYSCTLTMP);
                goto retry;

        error = SYSCTL_OUT(req, tmparg, outlen);
        free(tmparg, M_SYSCTLTMP);

When a device detaches strings can be left in freed memory, so 
"sysctl_handle_string" shouldn't try forever. Also the thread updating the 
string can sleep.



Should have a timeout count and something like:

u_int8_t to = 255;

goto retry;
else return EINVAL;

More information about the freebsd-bugs mailing list