freebsd kernel buffer overflow patch

[gerarra at tin.it]

Hi,
I've seen a potential problem in my patch; SYF_MPSAFE flag for MP safe syscalls
is not managed; maybe something like that is better:

===================================
kern/kern_syscalls.c:

--- kern_syscalls.c     Sat Sep 18 13:42:21 2004
+++ kern_syscalls2.c    Wed Sep 22 20:25:22 2004
@@ -35,6 +35,7 @@
 #include <sys/mutex.h>
 #include <sys/sx.h>
 #include <sys/module.h>
+#include <systm.h>

 /*
  * Acts like "nosys" but can be identified in sysent for dynamic call
@@ -58,6 +59,17 @@
 syscall_register(int *offset, struct sysent *new_sysent,
                 struct sysent *old_sysent)
 {
+#ifdef MAX_SYSCALL_ARGS
+       if (    (new_sysent->sy_narg & ~SYF_MPSAFE) < 0 ||
+               (new_sysent->sy_narg & ~SYF_MPSAFE) > MAX_SYSCALL_ARGS)
+       {
+               printf("Invalid sy_narg for syscall: boundary is [0 - %d]\n",
+                       MAX_SYSCALL_ARGS);
+               return EINVAL;
+       }
+#endif
+
+
        if (*offset == NO_SYSCALL) {
                int i;

complete diffs tree to http://www.gufi.org/~rookie/args-diff.tar.gz

rookie