[Bug 206761] Kernel stack overflow in sysctl handler for kern.binmisc.add

bugzilla-noreply at freebsd.org bugzilla-noreply at freebsd.org
Sun Jan 31 10:04:35 UTC 2016


--- Comment #6 from CTurt <cturt at hardenedbsd.org> ---
I didn't even notice this before, but you're right.


        if (imgact_binmisc_find_entry(xbe->xbe_name) != NULL) {
                return (EEXIST);

        /* Preallocate a new entry. */
        ibe = imgact_binmisc_new_entry(xbe);
        if (!ibe)
                return (ENOMEM);

        SLIST_INSERT_HEAD(&interpreter_list, ibe, link);

If the code ever reaches `return (ENOMEM);`, it is missing an
`sx_xunlock(&interp_list_sx);` call.

Unfortunately, this bug isn't triggerable, because `imgact_binmisc_add_entry`
uses `M_WAITOK` for its allocations, and so can never return `NULL`:

static imgact_binmisc_entry_t *
imgact_binmisc_new_entry(ximgact_binmisc_entry_t *xbe)
        ibe = malloc(sizeof(*ibe), M_BINMISC, M_WAITOK|M_ZERO);


        return (ibe);

My recommendation is to just remove the following check altogether:

        if (!ibe)
                return (ENOMEM);

You are receiving this mail because:
You are the assignee for the bug.

More information about the freebsd-bugs mailing list