From 87e109c3e0cc5ffab75b0d9745903cb372ea0ec1 Mon Sep 17 00:00:00 2001 From: "Pedro F. Giffuni" Date: Thu, 3 Jul 2014 19:07:37 +0000 Subject: [PATCH] Merge from OpenSolaris (22-Apr-2008): 6823388 DTrace ioctl handlers must validate all structure members MFC after: 1 week --- sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c | 3 ++- sys/cddl/contrib/opensolaris/uts/common/dtrace/fasttrap.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c b/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c index 20ce5b580b8..3f8284bf2b5 100644 --- a/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c +++ b/sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c @@ -12908,7 +12908,8 @@ dtrace_dof_copyin(uintptr_t uarg, int *errp) dof = kmem_alloc(hdr.dofh_loadsz, KM_SLEEP); - if (copyin((void *)uarg, dof, hdr.dofh_loadsz) != 0) { + if (copyin((void *)uarg, dof, hdr.dofh_loadsz) != 0 || + dof->dofh_loadsz != hdr.dofh_loadsz) { kmem_free(dof, hdr.dofh_loadsz); *errp = EFAULT; return (NULL); diff --git a/sys/cddl/contrib/opensolaris/uts/common/dtrace/fasttrap.c b/sys/cddl/contrib/opensolaris/uts/common/dtrace/fasttrap.c index 895b871b019..efb470b0d1d 100644 --- a/sys/cddl/contrib/opensolaris/uts/common/dtrace/fasttrap.c +++ b/sys/cddl/contrib/opensolaris/uts/common/dtrace/fasttrap.c @@ -2277,7 +2277,8 @@ fasttrap_ioctl(struct cdev *dev, u_long cmd, caddr_t arg, int fflag, probe = kmem_alloc(size, KM_SLEEP); - if (copyin(uprobe, probe, size) != 0) { + if (copyin(uprobe, probe, size) != 0 || + probe->ftps_noffs != noffs) { kmem_free(probe, size); return (EFAULT); }