Introduce a uiomove_frombuf helper routine that handles computing and

validating the offset within a given memory buffer before handing the
real work off to uiomove(9).

Use uiomove_frombuf in procfs to correct several issues with
integer arithmetic that could result in underflows/overflows.  As a
side-effect, the code is significantly simplified.

Add additional sanity checks when computing a memory allocation size
in pfs_read.

Submitted by:	rwatson  (original uiomove_frombuf -- bugs are mine :-)
Reported by:	Joost Pol <joost@pine.nl>  (integer underflows/overflows)

3 files changed, 9 insertions, 45 deletions

diff --git a/sys/fs/procfs/procfs_dbregs.c b/sys/fs/procfs/procfs_dbregs.c
index ae6e794..7ea4b91 100644
--- a/sys/fs/procfs/procfs_dbregs.c
+++ b/sys/fs/procfs/procfs_dbregs.c
@@ -65,31 +65,19 @@ procfs_doprocdbregs(PFS_FILL_ARGS)
 {
 	int error;
 	struct dbreg r;
-	char *kv;
-	int kl;
 
 	PROC_LOCK(p);
 	if (p_candebug(td, p) != 0) {
 		PROC_UNLOCK(p);
 		return (EPERM);
 	}
-	kl = sizeof(r);
-	kv = (char *) &r;
-
-	kv += uio->uio_offset;
-	kl -= uio->uio_offset;
-	if (kl > uio->uio_resid)
-		kl = uio->uio_resid;
 
 	_PHOLD(p);
-	if (kl < 0)
-		error = EINVAL;
-	else
-		/* XXXKSE: */
-		error = proc_read_dbregs(FIRST_THREAD_IN_PROC(p), &r);
+	/* XXXKSE: */
+	error = proc_read_dbregs(FIRST_THREAD_IN_PROC(p), &r);
 	if (error == 0) {
 		PROC_UNLOCK(p);
-		error = uiomove(kv, kl, uio);
+		error = uiomove_frombuf(&r, sizeof(r), uio);
 		PROC_LOCK(p);
 	}
 	if (error == 0 && uio->uio_rw == UIO_WRITE) {
diff --git a/sys/fs/procfs/procfs_fpregs.c b/sys/fs/procfs/procfs_fpregs.c
index b52f5ee..60150eb 100644
--- a/sys/fs/procfs/procfs_fpregs.c
+++ b/sys/fs/procfs/procfs_fpregs.c
@@ -59,31 +59,19 @@ procfs_doprocfpregs(PFS_FILL_ARGS)
 {
 	int error;
 	struct fpreg r;
-	char *kv;
-	int kl;
 
 	PROC_LOCK(p);
 	if (p_candebug(td, p)) {
 		PROC_UNLOCK(p);
 		return (EPERM);
 	}
-	kl = sizeof(r);
-	kv = (char *) &r;
-
-	kv += uio->uio_offset;
-	kl -= uio->uio_offset;
-	if (kl > uio->uio_resid)
-		kl = uio->uio_resid;
 
 	_PHOLD(p);
-	if (kl < 0)
-		error = EINVAL;
-	else
-		/* XXXKSE: */
-		error = proc_read_fpregs(FIRST_THREAD_IN_PROC(p), &r);
+	/* XXXKSE: */
+	error = proc_read_fpregs(FIRST_THREAD_IN_PROC(p), &r);
 	if (error == 0) {
 		PROC_UNLOCK(p);
-		error = uiomove(kv, kl, uio);
+		error = uiomove_frombuf(&r, sizeof(r), uio);
 		PROC_LOCK(p);
 	}
 	if (error == 0 && uio->uio_rw == UIO_WRITE) {
diff --git a/sys/fs/procfs/procfs_regs.c b/sys/fs/procfs/procfs_regs.c
index 1bdb58b..d3cad0f 100644
--- a/sys/fs/procfs/procfs_regs.c
+++ b/sys/fs/procfs/procfs_regs.c
@@ -59,31 +59,19 @@ procfs_doprocregs(PFS_FILL_ARGS)
 {
 	int error;
 	struct reg r;
-	char *kv;
-	int kl;
 
 	PROC_LOCK(p);
 	if (p_candebug(td, p)) {
 		PROC_UNLOCK(p);
 		return (EPERM);
 	}
-	kl = sizeof(r);
-	kv = (char *) &r;
-
-	kv += uio->uio_offset;
-	kl -= uio->uio_offset;
-	if (kl > uio->uio_resid)
-		kl = uio->uio_resid;
 
 	_PHOLD(p);
-	if (kl < 0)
-		error = EINVAL;
-	else
-		/* XXXKSE: */
-		error = proc_read_regs(FIRST_THREAD_IN_PROC(p), &r);
+	/* XXXKSE: */
+	error = proc_read_regs(FIRST_THREAD_IN_PROC(p), &r);
 	if (error == 0) {
 		PROC_UNLOCK(p);
-		error = uiomove(kv, kl, uio);
+		error = uiomove_frombuf(&r, sizeof(r), uio);
 		PROC_LOCK(p);
 	}
 	if (error == 0 && uio->uio_rw == UIO_WRITE) {