diff options
author | hselasky <hselasky@FreeBSD.org> | 2014-10-28 12:00:39 +0000 |
---|---|---|
committer | hselasky <hselasky@FreeBSD.org> | 2014-10-28 12:00:39 +0000 |
commit | a0b8ff0c54d6b632fe766de4566cee59bd8a4898 (patch) | |
tree | 63f2365a6dbce30caad91ca3b5ad545a2e4beb51 /sys/dev/acpica/acpi.c | |
parent | 2e5eee16fd7233cfa274ee05132fe6e0e542b1e7 (diff) | |
download | FreeBSD-src-a0b8ff0c54d6b632fe766de4566cee59bd8a4898.zip FreeBSD-src-a0b8ff0c54d6b632fe766de4566cee59bd8a4898.tar.gz |
The SYSCTL data pointers can come from userspace and must not be
directly accessed. Although this will work on some platforms, it can
throw an exception if the pointer is invalid and then panic the kernel.
Add a missing SYSCTL_IN() of "SCTP_BASE_STATS" structure.
MFC after: 3 days
Sponsored by: Mellanox Technologies
Diffstat (limited to 'sys/dev/acpica/acpi.c')
-rw-r--r-- | sys/dev/acpica/acpi.c | 15 |
1 files changed, 8 insertions, 7 deletions
diff --git a/sys/dev/acpica/acpi.c b/sys/dev/acpica/acpi.c index 1389bad..71fbe32 100644 --- a/sys/dev/acpica/acpi.c +++ b/sys/dev/acpica/acpi.c @@ -3783,6 +3783,7 @@ acpi_debug_sysctl(SYSCTL_HANDLER_ARGS) int error, *dbg; struct debugtag *tag; struct sbuf sb; + char temp[128]; if (sbuf_new(&sb, NULL, 128, SBUF_AUTOEXTEND) == NULL) return (ENOMEM); @@ -3806,16 +3807,16 @@ acpi_debug_sysctl(SYSCTL_HANDLER_ARGS) } sbuf_trim(&sb); sbuf_finish(&sb); - - /* Copy out the old values to the user. */ - error = SYSCTL_OUT(req, sbuf_data(&sb), sbuf_len(&sb)); + strlcpy(temp, sbuf_data(&sb), sizeof(temp)); sbuf_delete(&sb); - /* If the user is setting a string, parse it. */ + error = sysctl_handle_string(oidp, temp, sizeof(temp), req); + + /* Check for error or no change */ if (error == 0 && req->newptr != NULL) { - *dbg = 0; - kern_setenv((char *)oidp->oid_arg1, (char *)req->newptr); - acpi_set_debugging(NULL); + *dbg = 0; + kern_setenv((char *)oidp->oid_arg1, temp); + acpi_set_debugging(NULL); } ACPI_SERIAL_END(acpi); |