misc/177761: net-mgmt/net-snmp fails on certain kvm_read() calls via auto_nlist()

[Sean Bruno]

>Number:         177761
>Category:       misc
>Synopsis:       net-mgmt/net-snmp fails on certain kvm_read() calls via auto_nlist()
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Apr 10 18:40:00 UTC 2013
>Closed-Date:
>Last-Modified:
>Originator:     Sean Bruno
>Release:        10-current
>Organization:
FreeBSD Project
>Environment:
FreeBSD powernoodle 10.0-CURRENT FreeBSD 10.0-CURRENT #1 r248817M: Thu Mar 28 00:59:30 PDT 2013     sbruno at powernoodle:/usr/obj/usr/src/sys/POWERNOODLE  amd64

>Description:
a recent change to 9/stable and 10/current causes the following code snippet to fail
.. snip ...
static struct vmmeter sum;
..
auto_nlist("cnt", (char *)&sum, sizeof sum);


>How-To-Repeat:
Generate a small agent library that returns the contents a kvm_read() of "cnt" in kernel space.  Example code is a bit tricky, but can be supplied on request.
>Fix:
More or less, the memory was not zeroed in auto_nlist.c ... this indirectly casues the kvm_read() to get very bogus values and fail.  zero the memory out via calloc() or the attached patch to bzero it.

The diff is for 5.7.1 but is valid in my testing of 5.7.2

Patch attached with submission follows:

--- //depot/yahoo/ybsd_common/usr.local/net-snmp-5.7.1/agent/auto_nlist.c       2012-09-06 19:09:48.000000000 0000
+++ /home/seanbru/net-snmp-5.7.1/agent/auto_nlist.c     2012-09-06 19:09:48.000000000 0000
@@ -53,6 +53,7 @@
     }
     if (*ptr == 0) {
         *ptr = (struct autonlist *) malloc(sizeof(struct autonlist));
+                               bzero(*ptr, sizeof(struct autonlist));
         it = *ptr;
         it->left = 0;
         it->right = 0;



>Release-Note:
>Audit-Trail:
>Unformatted: